Insecure Direct Object Reference in OpenEMR Portal

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. The OnsitePortalActivityController::Update() function fails to properly validate record ownership. Instead of checking the database record's patient ID, it only compares the session's authenticated patient ID with the patientId field in the JSON request body. This allows authenticated portal patients to modify or take ownership of other patients' portal activity records by sending manipulated PUT requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to the /portal/patient/api/onsiteportalactivity/{id} endpoint. Check for requests where the patientId in the JSON payload does not match the session's authenticated patient ID. Look for unauthorized modifications to narratives, statuses, or record ownership in audit logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access sensitive data like clinical notes, activity status, payment invoices, or encrypted card details. They may overwrite narratives and statuses, take ownership of records, and compromise data integrity and audit trails. Exploitation requires only low privileges and no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of patient data, violating confidentiality and integrity requirements under GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, and compromised audit trails, potentially leading to regulatory penalties and loss of patient trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later. Implement strict ownership validation in the Update() method by comparing the session patient ID with the database record's PatientId, similar to the Read() method. Restrict PUT request access to authenticated users only.

Useful 0 Not Useful 0