Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the application's stdout log, interprets newline characters as real line breaks, and enforces no size or rate limits. Three independent abuse modes follow: log injection (forge log lines that look like legitimate system events), log volume DoS (saturate the logging pipeline at sustained 100+ requests per second of small messages), and oversized-payload submission (100 KB payloads accepted; larger sizes not tested). The most operationally damaging mode is log injection. An attacker can inject lines that an operator scanning logs would mistake for real system errors, mask their own activity behind fake noise, or pollute SIEM alerting rules with crafted false positives. A line such as `[error]: injected admin error` injected from an unauthenticated source is indistinguishable from the application's own error output once written to disk. Version 1.0.2 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T22:17:11.143Z",
  "pubdate": "2026-08-06T22:17:11.143Z",
  "executiveSummary": "OpenReception appointment booking software prior to version 1.0.2 is vulnerable to log injection, log volume denial of service, and oversized-payload submission via the unauthenticated /api/log endpoint. The root cause stems from the lack of authentication, schema validation, rate limiting, and size constraints on incoming POST requests, combined with the direct writing of attacker-controlled content and newline characters into the application stdout log. The most operationally damaging abuse mode is log injection, which allows an unauthenticated remote attacker to forge arbitrary log lines that mimic legitimate system events. This enables threat actors to mask unauthorized activity, generate false positives to pollute Security Information and Event Management (SIEM) alerting rules, and induce operational disruption through log pipeline saturation. Exploitation requires network access to the target endpoint without any prior authentication or special privileges. Remediation requires upgrading the affected software to version 1.0.2.",
  "technicalDetails": "The vulnerability resides in the /api/log endpoint of OpenReception prior to version 1.0.2, which is exposed to unauthenticated remote attackers over the network. The vulnerable component processes POST requests directed at the logging interface without enforcing authentication or privilege requirements. The root cause of the vulnerability is a combination of design flaws: the endpoint accepts unauthenticated POST requests, applies zero schema validation to the message body, enforces no payload size limits (accepting at least 100 KB payloads), and implements no rate limiting (vulnerable to sustained 100+ requests per second). Furthermore, the application takes attacker-controlled content, interprets newline characters as actual line breaks, and writes the resulting data directly into the application stdout log stream.\nThe attack flow proceeds in several distinct steps. First, an unauthenticated attacker crafts an arbitrary HTTP POST request containing malicious payloads directed at the /api/log endpoint. Because the application performs no schema validation or size checks, payloads up to 100 KB or larger are accepted. Second, the payload includes literal newline characters designed to break the logging stream into multiple fabricated log entries. Third, the application processes the request and writes the unescaped, attacker-controlled strings directly to stdout and disk logs. Finally, the injected text—such as [error]: injected admin error—renders indistinguishable from genuine application errors.\nThree distinct abuse modes are supported by this architectural flaw. Log injection enables the falsification of system events, misleading system operators and polluting SIEM alerting mechanisms with false positives. Log volume denial of service saturates the logging pipeline at sustained high request rates. Oversized-payload submission consumes excessive storage and processing resources. The vulnerability is fully resolved in version 1.0.2."
}