Missing Authorization in OpenEMR Classic Document Controller

Executive Summary

OpenEMR before version 8.3.0 has a missing authorization flaw in the classic document controller. Low-privilege authenticated users can exploit the move_action_process function to recategorize documents belonging to other patients. By moving a document into a demo-readable category like 'patients|demo', attackers can then retrieve it without specifying a patient ID, leading to unauthorized access to protected health information and potential tampering with patient records.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.3.0 for unauthorized document movements in the classic document controller. Review logs for suspicious use of move_action_process or document retrieval with empty patient_id parameters. Inspect database entries for documents moved to demo-readable categories like 'patients|demo'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access and steal sensitive patient data (PHI) from other users, modify patient records without authorization, and potentially cause persistent damage to medical charts. It specifically targets OpenEMR systems running versions before 8.3.0.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access and disclosure of PHI. It may also conflict with GDPR principles like data confidentiality and integrity. Organizations using affected OpenEMR versions could face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Verify the CONTROLLER_ACL_MAP includes the classic document controller to enforce proper access controls. Audit document categories and permissions to ensure no unauthorized movements occurred.

Useful 0 Not Useful 0