Missing Authorization in OpenEMR Allows Unauthorized Form Signing

Executive Summary

This vulnerability in OpenEMR before version 8.5.0 allows authenticated users to bypass proper authorization checks when submitting electronic forms. The system only verifies the user's password but does not confirm their access rights to the specific patient, encounter, or form type. This enables attackers to manipulate parameters like formId, formDir, and encounterId to sign and lock any patient's clinical form without authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances running versions before 8.5.0. Check for unauthorized form signatures or locked forms in clinical records. Review logs for suspicious requests to the esign_form_submit endpoint with manipulated parameters like formId, formDir, or encounterId.

Useful 0 Not Useful 0

Impact Analysis

An attacker could forge electronic signatures on protected clinical data, lock forms to prevent edits, and insert unauthorized amendments. This could mislead clinical or compliance reviews and interfere with record corrections. Normal editing of forms may also be blocked, disrupting workflows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized changes in patient records, violating integrity and availability requirements of standards like HIPAA and GDPR. Forged signatures and locked forms may result in non-compliance during audits, as records could be altered without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. If upgrading is not possible, restrict access to the esign_form_submit endpoint and implement additional authorization checks for form, patient, and encounter access.

Useful 0 Not Useful 0