CVE-2023-3285

Work through these to decide whether this CVE applies to you.

1. Identify if the /appointments endpoint exists and accepts POST requests
   Review application API documentation or use a network proxy to capture traffic and confirm the POST /appointments endpoint is exposed and functional in your environment
   Affected if The endpoint exists and processes POST requests without explicit testing of authorization boundaries
2. Determine the authentication requirements for the /appointments endpoint
   Attempt to send a POST request to /appointments without authentication headers or credentials and observe the response (401 Unauthorized indicates authentication is required; 200/201 indicates it may be accessible without auth)
   Affected if The endpoint accepts requests from unauthenticated users or accepts any authenticated session without privilege validation
3. Test whether a low-privilege user can specify a target user ID in the appointment creation request
   Log in with a low-privilege user account and submit a POST request to /appointments with a payload containing a target user parameter (such as user_id, target_user, or owner_id) set to a different user's ID (such as an admin account). Inspect the response and verify if the appointment was created for that other user
   Affected if A low-privilege authenticated user can successfully create an appointment for a different user, including administrators, without receiving a 403 Forbidden response
4. Check if the application validates authorization before creating appointments
   Review application logs or enable debug logging, then attempt to create an appointment as a low-privilege user targeting a privileged account. Look for authorization check logic in the backend code or proxy intercepts to confirm whether the server validates that the requester has permission to act on behalf of the target user
   Affected if No authorization validation occurs or the validation can be bypassed by manipulating the target user parameter in the request
5. Compare your deployed application version to any documented affected versions
   Check the application version in use (typically found in about pages, HTTP headers, source code, or configuration files) and compare it to any version ranges mentioned in CVE-2023-3285 documentation or release notes for the affected product
   Affected if The installed version falls within the range where this BOLA vulnerability exists and has not been patched
6. Verify if input validation exists for the target user parameter
   Intercept the POST /appointments request and examine the request body for user-referencing parameters (userId, user_id, targetUser, etc.). Attempt to send requests with manipulated values or unexpected data types and check if the application rejects them or processes them blindly
   Affected if The application accepts any value for the target user parameter without validating it against the authenticated user's identity or permissions

A user is affected if the POST /appointments endpoint allows an authenticated low-privilege user to create appointments for other users (including administrators) by specifying a target user parameter, indicating missing or insufficient authorization validation.

Generated from the published advisory. Verify against your own configuration.