A critical flaw in Microsoft Bookings allowed cybercriminals to manipulate meeting details due to weak input validation.
While Microsoft has mostly patched the issue, attackers were able to inject custom HTML into meeting invites, tamper with calendar entries, and even set the stage for complex phishing attacks.
This vulnerability arose from improper sanitization of user inputs in the Microsoft Bookings API. Key fields such as appointment.serviceNotes, appointment.additionalNotes, and appointment.body.content were not adequately validated, opening the door to HTML injection exploits.
Organizations relying on Microsoft Bookings for scheduling within the Microsoft 365 environment were impacted by this issue.
Exploitation of Rescheduling Feature for HTML & Link Manipulation
Reports from ERNW highlighted that the flaw was most easily triggered through the “Reschedule” feature. When users received a confirmation email with a rescheduling link, the unsanitized HTML from the original request remained intact and was included in a PUT request.
This created an opportunity for attackers to inject harmful code or links, leveraging this flaw for malicious purposes.
Of greater concern was the exploitation of the joinWebUrl parameter, which allowed attackers to insert misleading meeting links and images.
Teams Invitation Email
Furthermore, attackers had the ability to insert personalized calendar headers into ICS attachments through X-ALT-DESC and by adding extra ORGANIZER fields.
Custom Calendar Headers
The flaw introduced a range of serious security threats, including:
- Email and Calendar Tampering: Cybercriminals could alter event information such as descriptions and meeting URLs, potentially deceiving participants.
- Phishing Risk: The ability to inject HTML made it possible for attackers to embed convincing phishing links within trusted Microsoft domains.
- Data Integrity Concerns: Critical meeting details like timing, participant lists, and other booking data were vulnerable to modification.
- Resource Blocking: By manipulating event durations, attackers could extend meetings beyond their scheduled times, preventing legitimate users from making bookings.
- Creation of Undisclosed Mailboxes: Exploiting related vulnerabilities in Microsoft Bookings, attackers could create hidden mailboxes, bypassing usual administrative controls.
Updated Confirmation Email
Mitigation
The issue was first reported to the Microsoft Security Response Center in December 2024, with most vulnerabilities addressed by February 2025.
However, certain parameters such as additionalRecipients, startTime, and endTime were still found to have inadequate validation at that time.
Security professionals advise organizations to enforce strict input validation across all web applications, in line with CWE-20 (Improper Input Validation) guidelines.
For Microsoft Bookings, administrators should follow the security recommendations issued by Microsoft in March 2025, which include restricting access to booking pages and applying naming conventions.
Organizations utilizing Microsoft Bookings should make sure their systems are up-to-date with the latest security updates and consider enhanced monitoring for any unusual booking activity.
