CVE-2023-3287
📋 TL;DR
This CVE describes a Broken Object Level Authorization (BOLA) vulnerability in the Easy!Appointments scheduling software. It allows low-privileged users to create administrator accounts, leading to privilege escalation. Any organization using the vulnerable version of Easy!Appointments is affected.
💻 Affected Systems
- Easy!Appointments
📦 What is this software?
Easyappointments by Easyappointments
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control over the scheduling system, potentially accessing sensitive appointment data, modifying system configurations, or deploying additional malicious payloads.
Likely Case
An attacker creates an admin account for themselves, gaining unauthorized access to all scheduling functions and potentially sensitive customer data.
If Mitigated
With proper authorization checks and input validation, the vulnerability would be prevented, maintaining proper user privilege separation.
🎯 Exploit Status
Requires a low-privileged user account but the exploit is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check the GitHub repository for the latest patched version
Vendor Advisory: https://github.com/alextselegidis/easyappointments
Restart Required: No
Instructions:
1. Visit the GitHub repository. 2. Update to the latest version. 3. Verify the fix is applied.
🔧 Temporary Workarounds
Temporary endpoint restriction
allRestrict access to the /admins endpoint to authorized admin users only via web server configuration.
# Example for Apache: <Location "/admins"> Require valid-user Require group admin </Location>
# Example for Nginx: location /admins { deny all; }
🧯 If You Can't Patch
- Implement strict access controls and monitoring on the /admins endpoint.
- Regularly audit user accounts and privileges for unauthorized admin accounts.
🔍 How to Verify
Check if Vulnerable:
Test if a low-privileged user can successfully POST to the /admins endpoint to create an admin user.Check Version:
Check the application version in the admin panel or configuration files.Verify Fix Applied:
After patching, attempt the same test; it should fail with proper authorization errors.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admins endpoint from non-admin users
- Creation of new admin accounts from unexpected IP addresses or user accounts
Network Indicators:
- HTTP POST requests to /admins with user creation payloads
SIEM Query:
source="web_logs" AND uri_path="/admins" AND http_method="POST" AND user_role!="admin"