OpenEMR Missing Authorization in dynamic_finder_ajax.php

Executive Summary

This is a missing authorization vulnerability in OpenEMR versions before 8.5.0. It exists in dynamic_finder_ajax.php and allows authenticated users without patients/demo permission to query patient demographics by supplying arbitrary patient_data columns via the sColumns parameter. Attackers can enumerate sensitive patient information including names, dates of birth, contact details, and Social Security numbers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances for unauthorized access to dynamic_finder_ajax.php. Check server logs for requests to this endpoint with the sColumns parameter containing patient_data columns. Look for unusual enumeration of patient details like names, birthdates, or SSNs by users without patients/demo permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could exploit this to steal large amounts of sensitive patient data including personally identifiable information and medical contact details. This could lead to identity theft, fraud, or unauthorized access to medical records. The vulnerability enables bulk data enumeration across the entire practice.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates privacy regulations like HIPAA and GDPR by allowing unauthorized access to protected health information and personal data. It enables bulk data exposure which would constitute a data breach under these regulations, potentially resulting in significant fines and legal consequences for organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. If upgrading is not possible, restrict access to dynamic_finder_ajax.php by enforcing the patients/demo permission check in the AJAX handler and implementing an allowlist for output columns. Review server logs for signs of exploitation.

Useful 0 Not Useful 0