Authorization Bypass in OpenEMR FHIR Person Route

Executive Summary

This vulnerability is an authorization bypass in OpenEMR versions before 8.4.0. It allows patient-portal users with a SMART token to access staff members' personally identifiable information (PII) by bypassing compartment enforcement in the FHIR GET /fhir/Person/:uuid endpoint. Attackers can harvest staff Person UUIDs from Appointment references to retrieve names, addresses, phone numbers, and emails.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor FHIR API logs for unauthorized access attempts to /fhir/Person/:uuid endpoints by patient-portal users. Check for requests with patient SMART tokens attempting to access staff Person UUIDs. Review Appointment references for leaked staff UUIDs. Use network traffic analysis to identify abnormal data exfiltration patterns from FHIR endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you are a patient using OpenEMR before version 8.4.0, your data could be exposed. If you are a staff member, your personal information (name, address, phone, email) may be accessible to any patient with a valid SMART token. Organizations using vulnerable versions risk unauthorized data disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires strict access controls and data protection; HIPAA mandates safeguards for protected health information. Exploitation could lead to regulatory penalties, legal liabilities, and reputational damage for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade OpenEMR to version 8.4.0 or later to apply the official patch addressing compartment enforcement.
• Restrict patient SMART tokens to only access their own Person records by implementing IPatientCompartmentResourceService in FhirPersonService.
• Audit FHIR API access logs to identify and revoke any compromised patient tokens with patient/Person.read permissions.
• Implement additional validation checks in the GET /fhir/Person/:uuid endpoint to enforce proper compartment binding.

Useful 0 Not Useful 0