Executive brief
OpenReception's appointment booking platform is used by healthcare organizations to manage client scheduling and communications. The `/api/log` endpoint accepts unauthenticated requests without validation, allowing attackers to inject forged log entries that appear indistinguishable from legitimate system errors. An attacker can poison audit trails and SIEM alerts to mask malicious activity, or flood the logging system to cause denial of service and disk exhaustion.
Technical details
The `/api/log` endpoint exhibits a log-injection vulnerability caused by three missing security controls: lack of authentication, absence of input schema validation, and no rate or size limits. The vulnerability accepts unauthenticated POST requests, writes user-supplied JSON message content directly to stdout without sanitization, and interprets CRLF characters as real line breaks. An attacker can craft a POST request with embedded newlines to forge log lines that mimic legitimate system errors (e.g., `[error]: injected admin error`), making them indistinguishable from genuine application output when persisted to disk. Additionally, the endpoint permits payloads up to at least 100 KB with no observed rate limiting, enabling a volume-based denial-of-service attack that can sustain ~100 requests per second from a single source and potentially exhaust disk space. The vulnerability requires no authentication, session cookies, or prior access; any network-accessible attacker can exploit it. Version 1.0.2 applies input sanitization and rate limiting to fix the issue.
Affected products
- OpenReception appointment-booking-software <1.0.2
Timeline
- 2026-05-20: disclosed
- 2026-08-06: patched