Access Control Flaw in OpenEMR Exposes Patient C-CDA Documents

Executive Summary

OpenEMR before version 8.5.0 has an access control flaw in get_claim_file.php. When location=tmp is used, the system serves any file in the shared temporary directory without checking if the file belongs to the requesting user or is a valid claim file. This allows users with write access to acct/eob or acct/bill to download sensitive files like patient C-CDA documents by requesting key=ccda.xml.

The vulnerability occurs because OpenEMR uses a shared temporary directory and the downloader endpoint only verifies file existence, not ownership or legitimacy. An attacker can exploit this to access unauthorized files containing patient data.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions before 8.5.0 for the get_claim_file.php endpoint. Monitor access logs for requests with location=tmp and key=ccda.xml. Verify user permissions for acct/eob or acct/bill write access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users with specific permissions to access sensitive patient files, such as C-CDA clinical documents containing personal health information. Attackers could steal patient identities, medical histories, or other confidential data stored in temporary files.

The impact includes breach of patient privacy, potential legal consequences, and reputational damage for healthcare providers using vulnerable OpenEMR versions. The exploit requires specific permissions but can lead to significant data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA and GDPR by enabling unauthorized access to protected health information (PHI). HIPAA requires safeguards for PHI, and GDPR mandates strict data protection and breach notification. Exploiting this flaw could result in non-compliance, legal penalties, and loss of patient trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Restrict write permissions for acct/eob and acct/bill roles. Disable external C-CDA validation if not needed. Review and remove sensitive files from the shared temporary directory.

Useful 0 Not Useful 0