Executive brief
Easy!Appointments, an open-source appointment scheduling application, contains a security flaw in its CalDAV synchronization feature. A logged-in user, such as a staff member or administrator, can trick the server into making requests to internal network resources that are normally protected from the outside world. This could allow an attacker to map out the internal network or access sensitive information from other internal services like databases or mail servers.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in `Caldav::connect_to_server` within `application/controllers/Caldav.php`. The application fails to validate the `caldav_url` parameter before passing it to a Guzzle HTTP client for a `REPORT` request. An authenticated backend user (admin, provider, or secretary) can provide arbitrary URLs, including loopback (127.0.0.1) and RFC1918 private addresses. The vulnerability is semi-blind; while the full response is not returned, the Guzzle exception handler reflects the upstream HTTP status code and approximately 120 bytes of the response body in the JSON error message. This allows for internal port scanning and service fingerprinting. As of the advisory date, no official patch is available.
Affected products
- alextselegidis Easy!Appointments <= 1.5.2
Timeline
- 2026-06-15: disclosed
- 2026-07-29: advisory