Authenticated Portal Patient Access Bypass in OpenEMR

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. It allows authenticated portal patients to bypass authorization checks by submitting a capitalized 'Pid' parameter instead of the expected lowercase 'pid'. This lets attackers access other patients' onsite documents containing Protected Health Information (PHI) via the api/onsitedocuments endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions before 8.3.0 for the case-sensitive Pid parameter vulnerability. Monitor API requests to /portal/patient/api/onsitedocuments for unusual Pid parameter usage with capital P. Inspect logs for GET requests with Pid=<victim_pid> patterns.

Useful 0 Not Useful 0

Impact Analysis

If you are an OpenEMR user running versions before 8.3.0, an attacker with portal access could exploit this to view your PHI, including documents containing sensitive health information. This could lead to privacy breaches, identity theft, or unauthorized disclosure of medical records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability poses a significant risk to HIPAA compliance as it allows unauthorized access to PHI, violating the HIPAA Security Rule's requirements for protecting electronic protected health information. It may also impact GDPR compliance by failing to ensure adequate protection of personal data, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Implement case-insensitive patient ID validation in the portal guard. Review and restrict access to the api/onsitedocuments endpoint. Monitor for unauthorized document access attempts.

Useful 0 Not Useful 0