Path Traversal in OpenEMR FaxSMS Module

Executive Summary

This is a path traversal vulnerability in OpenEMR versions before 8.3.0 affecting the FaxSMS module. It allows authenticated low-privilege users to read and overwrite arbitrary files via unsanitized file_path parameter in RCFaxClient and SignalWireClient disposeDocument functions.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.3.0. Inspect FaxSMS module logs for unusual file_path parameters in POST requests. Look for requests to /modules/FaxSMS/ with action=download or action=setup. Monitor for unauthorized file reads or writes in web-accessible directories.

Useful 0 Not Useful 0

Impact Analysis

Attackers can read sensitive files like sqlconf.php containing database credentials and keys. They can also overwrite web-server-writable files with malicious content, potentially causing service disruption or data corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of database credentials and patient data would result in compliance breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later. Apply input validation to the file_path parameter in RCFaxClient and SignalWireClient disposeDocument functions. Restrict file permissions to prevent unauthorized writes. Review and remove unnecessary web-server-writable files.

Useful 0 Not Useful 0