Insecure Direct Object Reference in OpenEMR Exposes Patient Documents

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. It allows authenticated portal patients to read other patients' documents by manipulating request parameters like Pid_Equals, Pid_GreaterThan, or Pid_In. The OnsiteDocumentController::Query() method incorrectly allows these parameters to override the session patient ID, bypassing authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to the onsitedocuments endpoint for suspicious parameters like Pid_Equals, Pid_GreaterThan, or Pid_In. Check server logs for requests with these parameters from authenticated portal patients accessing documents not belonging to them.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid portal-patient session could access other patients' sensitive documents, including signed consent forms, signatures, and protected health information (PHI). This could lead to unauthorized disclosure of personal data without additional privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access to PHI and GDPR due to unauthorized processing of personal data. It enables data breaches that could result in significant legal and financial penalties for organizations failing to protect patient information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not immediately possible, implement input validation to reject Pid-related request parameters in the onsitedocuments API. Ensure session-based patient ID checks are enforced strictly after parameter processing.

Useful 0 Not Useful 0