Authenticated File Read via mPDF in OpenEMR

Executive Summary

This is a Local File Disclosure vulnerability in OpenEMR versions before 8.5.0. Authenticated users can pass malicious HTML content through the doc_lib.php parameter to the mPDF library, which then resolves local files and nested SVG resources. Attackers can use crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/version.php. If version is below 8.5.0, the system is vulnerable. Inspect doc_lib.php and PatientPortalPDFDocumentCreator.php for user-controlled HTML handling. Monitor server logs for unusual PDF generation requests or file access patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access can read sensitive files on the server such as credentials, OAuth keys, configuration files, or user data. This could lead to further attacks like account takeover, data theft, or service disruption. Memory exhaustion is also possible through excessive php://filter chains.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Disable or restrict access to the doc_lib.php PDF renderer until patched. Implement strict input validation for HTML content passed to mPDF. Remove restoration of original <style> blocks in PDF generation code.

Useful 0 Not Useful 0