Insecure Direct Object Reference in OpenEMR Portal Settings

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. It allows an authenticated portal patient to modify settings for other patients by changing the setting_patient parameter in API requests. The flaw is in portal/lib/persist.php where the code does not verify if the setting_patient value matches the authenticated user's PID before writing settings.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to portal/lib/persist.php for JSON payloads containing the setting_patient parameter with values different from the authenticated user's PID. Check for unauthorized modifications to patient portal settings such as themes.

Useful 0 Not Useful 0

Impact Analysis

An attacker with portal access could change another patient's portal settings, such as theme preferences, by sending a crafted POST request. This could lead to unauthorized modifications of patient records, though it requires valid authentication to exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized access and modification of patient data. GDPR requires strict protection of personal data, and HIPAA mandates safeguards for protected health information (PHI). The IDOR flaw allows attackers to alter patient settings, which may expose sensitive data or settings without consent, undermining these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not possible, implement input validation to ensure the setting_patient parameter matches the authenticated user's PID before processing requests.

Useful 0 Not Useful 0