Improper Authorization in OpenEMR Exposes Patient Data

Executive Summary

This vulnerability is an improper authorization flaw in OpenEMR versions before 8.5.0. It exists in the file interface/orders/order_manifest.php and allows users with only patients/med view permission to read squad-restricted patient data and modify lab-order flags without proper access controls or CSRF validation.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.5.0 for the file interface/orders/order_manifest.php. Monitor for unauthorized POST requests to this file with parameters like bn_save or form_omit from users with only patients/med view permissions. Review logs for requests accessing squad-restricted patient data without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

An attacker with read-only access could suppress lab procedures by setting do_not_send flags, leading to incomplete lab orders and delayed testing. In squad deployments, they could also view and modify orders for patients outside their access scope.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Implement strict access controls requiring write permissions for modifying lab-order flags. Enforce patient squad restrictions and verify order ownership. Add CSRF token validation to POST requests in order_manifest.php.

Useful 0 Not Useful 0