Authorization Bypass in OpenEMR Exposes Patient Data

Executive Summary

OpenEMR versions before 8.4.0 have an authorization bypass flaw. Low-privileged users with SMART standalone-launch access can bind arbitrary patient UUIDs into OAuth tokens. This allows attackers with minimal permissions to access clinical notes and documents of other patients via FHIR endpoints.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor OpenEMR logs for unauthorized access attempts to patient-scoped FHIR endpoints like /fhir/DocumentReference and /fhir/Binary/:id. Check for unusual OAuth token contexts containing arbitrary patient UUIDs (puuid) in session data. Review access control lists (ACLs) for users with patients|demo privileges and verify they are not binding unauthorized patient UUIDs during SMART launches.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive patient data such as clinical notes and documents. Attackers could view or steal confidential medical information without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates privacy regulations like HIPAA and GDPR by enabling unauthorized access to protected health information. It could result in legal penalties, loss of patient trust, and compliance violations for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later to address the authorization bypass vulnerability. Review and restrict SMART standalone-launch user permissions to prevent unauthorized patient UUID binding.

Useful 0 Not Useful 0