PT-2022-13857 · Unknown · Easyappointments

Published 2022-05-10 · Updated 2022-05-16 · CVE-2022-1397

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions easyappointments versions prior to 1.5.0

Description The issue concerns an API privilege escalation in the easyappointments GitHub repository. It allows a low-privileged user, such as a provider, to create a new admin user via the "/api/v1/admins/" endpoint, potentially leading to full system takeover. This is due to the API authorization checking the user's existence without validating their permissions.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v1/admins/" endpoint to prevent unauthorized creation of admin users. Additionally, review user permissions and validate them properly to prevent privilege escalation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-1397

GHSA-7F62-4887-CFV5

Affected Products

Easyappointments

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1397.json · Exploit
• 🔥 https://huntr.dev/bounties/5f69e094-ab8c-47a3-b01d-8c12a3b14c61 · Exploit
• https://github.com/alextselegidis/easyappointments/commit/63dbb51decfcc1631c398ecd6d30e3a337845526 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1397 · Security Note
• https://osv.dev/vulnerability/GHSA-7f62-4887-cfv5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1397 · Vendor Advisory
• https://github.com/alextselegidis/easyappointments · Note
• https://t.me/cibsecurity/42253 · Telegram Post