AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).
- 15 BOLA/IDOR flaws found via an automated GenAI detection tool
- Nine CVEs rated Critical (CVSS 9.9), including privilege escalation to admin
- All issues patched in Easy!Appointments version 1.5.0
- BOLA ranks as the number one risk in the OWASP API Top 10
- CVEs
- CVE-2023-3285CVE-2023-3286CVE-2023-3287CVE-2023-3288CVE-2023-3289CVE-2023-3290CVE-2023-38047CVE-2023-38048CVE-2023-38049CVE-2023-38050CVE-2023-38051CVE-2023-38052CVE-2023-38053CVE-2023-38054CVE-2023-38055CVE-2024-1313
- Products
- Easy!AppointmentsGrafana
- Threat actors
- Unit 42
- Organizations
- Palo Alto NetworksUnit 42
- Countries
- US
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-3285 | A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin) | 7.7 | <1% | ||
| CVE-2023-3287 | A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system | 8.8 group max | <1% | ||
| CVE-2024-1313 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to… | 6.5 | <1% |
From the original article
8 min read at unit42.paloaltonetworks.com
Palo Alto Networks has been actively researching and developing security capabilities using AI . In an effort to audit web applications for Broken Object-Level Authorization (BOLA) vulnerabilities, Unit 42 researchers developed an automated BOLA detection tool leveraging GenAI. In 2023, we used our tool to test an open-source project, Easy!
By Ravid Mazon, Jay Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.