CVE-2026-52840

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind. Version 1.6.0 contains a patch.

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind. Version 1.6.0 contains a patch.

Summary

Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind.

Preconditions

• Backend login on the target instance. Non-admin attackers supply their own provider_id and pass the per-row check at Caldav.php:52; admins can target any row.
• Default deployment per the project's own docker-compose.yml, which puts mysql, mailpit, phpmyadmin, baikal, openldap, phpldapadmin, and swagger-ui on the same docker network as php-fpm.

Details

// application/controllers/Caldav.php:45-82
public function connect_to_server(): void
{
    try {
        $provider_id = request('provider_id');
        $user_id = session('user_id');

        if (cannot('edit', PRIV_USERS) && (int) $user_id !== (int) $provider_id) {
            throw new RuntimeException('You do not have the required permissions for this task.');
        }

        $caldav_url = request('caldav_url');                                  // (*) attacker-controlled
        $caldav_username = request('caldav_username');
        $caldav_password = request('caldav_password');

        $this->caldav_sync->test_connection($caldav_url, $caldav_username, $caldav_password);  // (*) sink
        ...
    } catch (GuzzleException | InvalidArgumentException $e) {
        json_response([
            'success' => false,
            'message' => $e->getMessage(),                                    // (*) upstream body reflected
        ]);
    }
}

The per-row check at line 52 only constrains which provider record the caller may write to; it does not constrain where the outbound request lands. $caldav_url flows unchanged into Caldav_sync::test_connection at application/libraries/Caldav_sync.php:389, which calls get_http_client to construct a Guzzle client whose base_uri is the attacker URL (Caldav_sync.php:375-382), then issues REPORT against it via fetch_events at Caldav_sync.php:558. The only input check in get_http_client is filter_var($caldav_url, FILTER_VALIDATE_URL) at line 363, which validates the URL grammar - not the host - so loopback, RFC1918, link-local, and arbitrary internal hostnames pass.

When Guzzle raises RequestException, its getMessage() formats as Client error: `REPORT http://target/` resulted in a `405 Method Not Allowed` response: <body truncated to ~120 chars>. Caldav::connect_to_server returns that string verbatim in message. For ConnectException (port closed, DNS failure, TLS handshake error) the message names the host, port, and underlying cURL error number - enough to port-scan the deployment's network.

Proof of concept

Setup

1. Clone the repository, pin to the audited release, copy the sample config, and bring up the bundled stack:

   git clone https://github.com/alextselegidis/easyappointments
   cd easyappointments
   git checkout 1.5.2
   cp config-sample.php config.php
   docker compose up -d
   until curl -fsS http://localhost/ -o /dev/null; do sleep 2; done
   

2. Run the console installer. The seed sets administrator's password to the literal string administrator (application/libraries/Instance.php:99):

   docker compose exec -T php-fpm php index.php console install
   

3. Log in as administrator (the project's session cookie is ea_session) and create an attacker provider. The default require_phone_number=1 setting makes phone_number mandatory:

   export ADMIN_JAR=/tmp/admin.cookies
   curl -s -c $ADMIN_JAR http://localhost/index.php/login -o /dev/null
   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR)…
   

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind. Version 1.6.0 contains a patch.

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind. Version 1.6.0 contains a patch.

Summary

Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind.

Preconditions

• Backend login on the target instance. Non-admin attackers supply their own provider_id and pass the per-row check at Caldav.php:52; admins can target any row.
• Default deployment per the project's own docker-compose.yml, which puts mysql, mailpit, phpmyadmin, baikal, openldap, phpldapadmin, and swagger-ui on the same docker network as php-fpm.

Details

// application/controllers/Caldav.php:45-82
public function connect_to_server(): void
{
    try {
        $provider_id = request('provider_id');
        $user_id = session('user_id');

        if (cannot('edit', PRIV_USERS) && (int) $user_id !== (int) $provider_id) {
            throw new RuntimeException('You do not have the required permissions for this task.');
        }

        $caldav_url = request('caldav_url');                                  // (*) attacker-controlled
        $caldav_username = request('caldav_username');
        $caldav_password = request('caldav_password');

        $this->caldav_sync->test_connection($caldav_url, $caldav_username, $caldav_password);  // (*) sink
        ...
    } catch (GuzzleException | InvalidArgumentException $e) {
        json_response([
            'success' => false,
            'message' => $e->getMessage(),                                    // (*) upstream body reflected
        ]);
    }
}

The per-row check at line 52 only constrains which provider record the caller may write to; it does not constrain where the outbound request lands. $caldav_url flows unchanged into Caldav_sync::test_connection at application/libraries/Caldav_sync.php:389, which calls get_http_client to construct a Guzzle client whose base_uri is the attacker URL (Caldav_sync.php:375-382), then issues REPORT against it via fetch_events at Caldav_sync.php:558. The only input check in get_http_client is filter_var($caldav_url, FILTER_VALIDATE_URL) at line 363, which validates the URL grammar - not the host - so loopback, RFC1918, link-local, and arbitrary internal hostnames pass.

When Guzzle raises RequestException, its getMessage() formats as Client error: `REPORT http://target/` resulted in a `405 Method Not Allowed` response: <body truncated to ~120 chars>. Caldav::connect_to_server returns that string verbatim in message. For ConnectException (port closed, DNS failure, TLS handshake error) the message names the host, port, and underlying cURL error number - enough to port-scan the deployment's network.

Proof of concept

Setup

1. Clone the repository, pin to the audited release, copy the sample config, and bring up the bundled stack:

   git clone https://github.com/alextselegidis/easyappointments
   cd easyappointments
   git checkout 1.5.2
   cp config-sample.php config.php
   docker compose up -d
   until curl -fsS http://localhost/ -o /dev/null; do sleep 2; done
   

2. Run the console installer. The seed sets administrator's password to the literal string administrator (application/libraries/Instance.php:99):

   docker compose exec -T php-fpm php index.php console install
   

3. Log in as administrator (the project's session cookie is ea_session) and create an attacker provider. The default require_phone_number=1 setting makes phone_number mandatory:

   export ADMIN_JAR=/tmp/admin.cookies
   curl -s -c $ADMIN_JAR http://localhost/index.php/login -o /dev/null
   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR)…