Stored XSS in OpenEMR Patient Portal via Document Template

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. Attackers can inject malicious javascript: URLs into document template_data, which are then rendered unsanitized into an iframe src by DocumentTemplateRender. This allows JavaScript to execute in staff sessions, potentially reading protected health information (PHI) and CSRF tokens.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions before 8.5.0 for the vulnerability. Inspect document templates in the onsite_documents table for javascript: URLs in template_data fields. Monitor staff sessions for unexpected JavaScript execution when reviewing patient documents.

Useful 0 Not Useful 0

Impact Analysis

If you are a staff member using OpenEMR before 8.5.0, an attacker could steal your session data, including PHI and CSRF tokens. The attacker could then perform unauthorized actions on your behalf, such as accessing or modifying patient records, or escalating privileges if you are an administrator.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of protected health information (PHI), violating HIPAA requirements for safeguarding patient data. It may also result in non-compliance with GDPR if personal data of EU citizens is compromised, potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Review and sanitize all template_data entries in the onsite_documents table. Implement input validation for encounterForm values to prevent javascript: URL injection.

Useful 0 Not Useful 0