Broken Object Level Authorization in OpenEMR Portal

Executive Summary

OpenEMR before version 8.3.0 has a broken object level authorization flaw in the portal/report/portal_custom_report.php file. This allows authenticated portal patients to access other patients' problem list entries by guessing sequential IDs in the issue_ parameter. Attackers can retrieve sensitive data like problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenEMR versions before 8.3.0. Look for unauthorized access to portal_custom_report.php by monitoring logs for sequential ID enumeration in the issue_ parameter. Test by accessing the URL with different issue_ values to see if other patients' records are exposed.

Useful 0 Not Useful 0

Impact Analysis

If you are a patient using OpenEMR before 8.3.0, an attacker with portal access could view your medical records, including diagnoses, treatment notes, and contraceptive history. This could lead to privacy breaches, identity theft, or misuse of sensitive health information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates privacy regulations like GDPR and HIPAA by allowing unauthorized access to protected health information. It could result in legal penalties, loss of patient trust, and reputational damage for healthcare providers using affected OpenEMR versions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later. If upgrading is not possible, restrict access to portal_custom_report.php and monitor for suspicious activity. Apply network-level controls to block unauthorized access attempts.

Useful 0 Not Useful 0