Multiple Vulnerabilities Identified in OpenEMR Health Record and Practice Management Software
Multiple vulnerabilities have been identified in the popular open source electronic health record and medical practice management software, OpenEMR. OpenEMR is used by healthcare organizations around the world for recording and managing sensitive patient data, and patients used the software for scheduling appointments online, communicating with their healthcare providers, and paying medical bills. OpenEMR is used by more than 100,000 healthcare providers worldwide that serve more than 200 million patients.
Three vulnerabilities were discovered last year by security researcher Dennis Brinkrolf. Brinkrolf analyzed the open source code using Sonar’s static application security testing (SAST) engine. Three vulnerabilities were identified that could be chained together to achieve remote code execution, take control of vulnerable OpenEMR instances, and steal sensitive patient data.
The first vulnerability – an unauthenticated file read vulnerability – could be exploited by a malicious actor using a rogue MySQL server to read arbitrary files in OpenEMR systems. Those files contain certificates, passwords, tokens, and backups. The other two vulnerabilities – an authenticated local file inclusion flaw and authenticated reflected XSS vulnerability – can be exploited in combination with the first vulnerability to execute arbitrary code on any vulnerable OpenEMR server and steal sensitive data. In the worst-case scenario, the attacker would be able to compromise the entire critical infrastructure of an organization.
For instance, the reflected XSS vulnerability could be exploited to upload a malicious PHP file to the server. The attacker could then use path traversal via the Local File Inclusion bug to execute the PHP file. While it may take several attempts to determine the appropriate Unix timestamp, the attacker would eventually be able to achieve remote code execution and could configure the system in a way to allow data exfiltration.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Brinkrolf reported the vulnerabilities to OpenEMR on October 24, 2022, and patches were released to fix all three vulnerabilities within a week. Medical practices that use OpenEMR should check to make sure they are running the latest version of the software, and if they are running any version prior to 7.0.0 they should update the software immediately.
