CVE-2024-57601

Analysis

Easy!Appointments is an open-source self-hosted appointment scheduler. In version 1.5.0, a Cross-Site Scripting (XSS) vulnerability exists in the backend administrative interface, specifically through the legal_settings parameter. This parameter is used to configure legal text such as terms and conditions or privacy policies, which are displayed to users during the booking process. The application fails to properly sanitize user-supplied input before storing it, allowing an attacker to inject arbitrary HTML and JavaScript code [1].

The vulnerability is exploitable by any authenticated user who has access to the administrative backend, typically a provider or administrator. The attacker can submit malicious payloads via the legal_settings input fields. Because the stored content is rendered without sufficient sanitization, the injected script executes in the context of any user—including other administrators—who views the legal settings page. No special network access beyond standard web application interaction is required [2].

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any administrative user. This can lead to session hijacking, credential theft via phishing overlays, defacement of the admin panel, or performing administrative actions on behalf of the victim (e.g., creating or modifying appointments, altering provider information). The impact is limited to the browser session of authenticated backend users, but it can compromise the entire application's administrative operations.

As of February 2025, the vendor has not released a security patch addressing this vulnerability. Users are advised to sanitize legal settings input manually (e.g., using a content security policy or HTML encoding), restrict administrative account access to trusted personnel, and monitor for updates from the official repository. The vulnerability has not yet been added to CISA's Known Exploited Vulnerabilities catalog, but exploitation is plausible given the public disclosure [2].