OpenEMR Denial of Service via ZIP Archive Compression

Executive Summary

OpenEMR before version 8.5.0 has a denial of service vulnerability in four ZIP file upload paths. The issue occurs because the software reads uncompressed ZIP entries into memory without checking their size or compression ratio. Authenticated users with billing or care coordination roles can exploit this by uploading highly compressed ZIP archives, which consume excessive PHP memory and worker pools, leading to system unavailability.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high memory usage during ZIP upload operations in OpenEMR. Check PHP error logs for memory exhaustion errors. Inspect network traffic for repeated ZIP upload attempts from authenticated users.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenEMR versions before 8.5.0, an attacker with authenticated access could upload malicious ZIP files to crash the system. This would make OpenEMR unavailable, disrupting healthcare operations, patient data access, and billing processes. The attack requires valid user credentials but could severely impact service availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to prolonged downtime of OpenEMR, potentially causing violations of HIPAA due to unavailability of protected health information systems. GDPR compliance may also be affected if patient data processing is interrupted. Organizations must ensure system availability to meet regulatory requirements for data access and security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Implement size and ratio checks for ZIP uploads. Restrict ZIP upload permissions to only necessary user roles. Monitor PHP memory limits and worker pool usage.

Useful 0 Not Useful 0