Authorization Bypass in OpenEMR Exposes Patient Data

Executive Summary

OpenEMR before version 8.5.0 has an authorization bypass flaw in the file portal/lib/download_template.php. This allows any authenticated core user to access documents for any patient by manipulating parameters like pid and template_id. The vulnerability bypasses access control lists (ACL) and squad restrictions, enabling unauthorized disclosure of sensitive patient data.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions before 8.5.0 for the file portal/lib/download_template.php. Look for unauthorized document access attempts where users submit arbitrary pid and template_id values. Monitor logs for unusual document rendering requests.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of OpenEMR before 8.5.0, an attacker with basic authentication could exploit this to view private patient records, including names, birth dates, addresses, allergies, medications, and medical history. This could lead to privacy breaches, identity theft, or misuse of sensitive health information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information (PHI). GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for patient data. Exploitation could result in regulatory penalties, legal liabilities, and reputational damage for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Review and restrict access to portal/lib/download_template.php. Implement strict input validation for pid and template_id parameters. Audit logs for past unauthorized access attempts.

Useful 0 Not Useful 0