Remote Code Execution in OpenEMR via Malicious ERA File Upload

Executive Summary

OpenEMR before version 8.5.0 has a remote code execution flaw. Authenticated billing users can upload a malicious ERA file to era_payments.php, which stores attacker-controlled PHP code. Attackers with database-write access, such as via SQL injection, can create a background_services entry that loads the stored .edi file, executing PHP as the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in OpenEMR directories, especially files with unusual names or recent modification dates. Inspect the era_payments.php and background_services table for suspicious entries. Review uploaded ERA files for malformed content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server running OpenEMR. This could lead to full system compromise, data theft, unauthorized access to sensitive information, or further network infiltration. Systems running vulnerable versions are at risk if attackers gain authenticated access or exploit other vulnerabilities like SQL injection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive patient or user data, violating GDPR and HIPAA requirements for data protection and access control. Compliance failures may result in legal penalties, fines, and reputational damage due to compromised personal health information or other regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Remove any unauthorized PHP files. Restrict database-write permissions for billing users. Monitor for unusual file uploads or database activity.

Useful 0 Not Useful 0