Authorization Bypass in OpenEMR Exposes Patient Questionnaire Responses

Executive Summary

OpenEMR before version 8.4.0 has an authorization bypass flaw where patient-scoped SMART tokens can access other patients' questionnaire responses. The FhirQuestionnaireResponseService does not enforce patient-specific data isolation by not implementing the IPatientCompartmentResourceService interface. Attackers with a valid token can read responses by UUID or list unfiltered bundles to obtain cross-patient clinical assessment data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenEMR versions prior to 8.4.0. Review FHIR API logs for unauthorized access to questionnaire responses by UUID or unfiltered bundle requests. Look for patient-scoped SMART tokens accessing unrelated patient data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to sensitive patient health information (PHI) such as clinical assessments. Attackers with a patient-scoped token can read other patients' questionnaire responses, leading to privacy breaches and potential misuse of confidential medical data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates privacy regulations like HIPAA and GDPR by enabling unauthorized access to protected health information. It compromises patient data confidentiality, potentially leading to legal penalties, reputational damage, and loss of trust in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Ensure FhirQuestionnaireResponseService and FhirQuestionnaireResponseFormService implement IPatientCompartmentResourceService to enforce patient data isolation.

Useful 0 Not Useful 0