OpenEMR Broken Object-Level Authorization in SOAP Note Update

Executive Summary

This is a broken object-level authorization vulnerability in OpenEMR versions before 8.3.0. It affects the SOAP note update API, which fails to verify that a supplied SOAP note ID belongs to the specified patient and encounter. Authenticated users with encounters/notes permissions can exploit this by sending PUT requests to overwrite another patient's clinical note and reassign its patient ID.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to the OpenEMR SOAP note update API endpoint /api/patient/:pid/encounter/:eid/soap_note/:sid. Check for requests where the sid parameter does not match the expected patient or encounter bindings. Review logs for unauthorized modifications to SOAP notes or unexpected changes in patient ID assignments.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access could modify or delete clinical notes belonging to other patients, leading to incorrect medical records, misdiagnosis, or fraud. It compromises data integrity and confidentiality of sensitive patient information, potentially affecting treatment outcomes and legal compliance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates regulations requiring patient data integrity and confidentiality, such as HIPAA (for healthcare data) and GDPR (for personal data). Unauthorized modification of patient records can lead to non-compliance, legal penalties, and loss of trust in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the SOAP note update API endpoint and enforce strict object-level authorization checks. Review all SOAP notes for unauthorized modifications and audit user permissions to ensure only authorized users have encounters/notes permissions.

Useful 0 Not Useful 0