Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

Vulnerability

Overview

CVE-2023-2102 is a stored cross-site scripting (XSS) vulnerability in the Easy!Appointments open-source appointment scheduler, affecting versions prior to 1.5.0. The root cause is insufficient escaping of the user display name when rendered in the backend administrative interface [1][3]. This allows an attacker to inject arbitrary HTML or JavaScript code that persists on the server and executes in the context of other users viewing the affected page.

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have the ability to set or modify a user's display name, which typically requires authenticated access with at least provider or admin privileges [2]. The injected payload is stored in the database and later rendered without proper sanitization in the backend section, meaning any user with access to that area (e.g., other administrators or providers) will execute the malicious script when viewing the affected record [3]. No special network position is required beyond normal web application access.

Impact

Successful exploitation allows an attacker to perform actions on behalf of other backend users, such as stealing session cookies, exfiltrating sensitive data, or performing unauthorized administrative operations. Because the XSS is stored, the attack can affect multiple users over time without requiring further interaction from the attacker [1][4].

Mitigation

The vulnerability was addressed in commit bddc5cbeb7ff237a72943b304dcb01c653781767, which escapes the user display name in the backend section [3]. Users are strongly advised to upgrade to Easy!Appointments version 1.5.0 or later, which includes this fix [1][2]. No workarounds have been officially documented, but restricting backend user privileges and applying input validation can reduce risk until an upgrade is performed.