Stored XSS in OpenEMR Eye Exam Patient Report

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.3.0. It exists in the Eye Exam Document Notes feature, specifically in the file interface/forms/eye_mag/report.php. Authenticated users with document-note write access can inject malicious JavaScript into retina document notes. When clinicians generate the Eye Exam patient report, the injected script executes in their browser session.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/CommonFunctions.php. Inspect interface/forms/eye_mag/report.php for missing text() escaping on Note::get_note() output. Review document notes in the Eye Exam module for suspicious JavaScript payloads like <img src=x onerror=...>.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute malicious scripts in the context of a clinician's browser session. This could lead to session theft, account takeover, phishing attacks, unauthorized actions, or exposure of sensitive patient data. Attackers need document-note write access, such as a nurse or medical assistant role, to exploit this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive patient data, which may violate HIPAA's requirements for protecting protected health information. It could also result in data breaches that require notification under GDPR, potentially leading to fines or penalties for non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Apply the text() escaping function to Note::get_note() output in report.php line 2555. Sanitize input at persistence by stripping HTML tags in Note::persist(). Restrict document-note write access to trusted users only.

Useful 0 Not Useful 0