Improper Authorization in OpenEMR Patient Tracker Status

Executive Summary

This vulnerability is an improper authorization flaw in OpenEMR versions before 8.5.0. It allows low-privilege authenticated users to modify tracker entries of other patients by submitting arbitrary tracker_id values. Attackers can alter patient-flow status, room assignments, and linked calendar appointments by sending statustype and roomnum parameters with a valid CSRF token.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor OpenEMR logs for unauthorized modifications to patient_tracker_status.php. Check for POST requests with statustype and roomnum parameters from low-privilege users. Look for CSRF token validation without proper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate patient-flow status, change room assignments, or interfere with scheduling without needing admin rights. This could misrepresent clinical workflow progress, disrupt patient management, or cause scheduling conflicts. The integrity of patient data and system operations may be compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with regulations like HIPAA by allowing unauthorized modifications to patient data and scheduling, compromising data integrity and confidentiality. GDPR may also be affected due to potential unauthorized processing of personal data. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. Ensure proper authorization checks are implemented in patient_tracker_status.php to validate user permissions before allowing modifications. Review and restrict access to CSRF tokens for low-privilege users.

Useful 0 Not Useful 0