In a recent customer project, we discovered vulnerabilities in Microsoft Bookings, an online appointment scheduling tool integrated into Microsoft 365, allowing companies to have customers book meetings in available times themselves. The findings originate from insufficient input validation on the public meeting scheduling endpoint. Although Microsoft has largely mitigated this vulnerability, our analysis provides important insights into potential risks and areas for improvement.
Introduction & Context
Microsoft Bookings is a service that allows organizations to manage appointments and meetings via a web interface. With integration to services such as Microsoft Teams, the security of the booking process is critical. This blog post outlines our technical analysis of the vulnerability, including proof-of-concept details and an overview of the vendor response.
Continue reading