OpenEMR FHIR Binary Download Time-Limited PHI Exposure

Executive Summary

OpenEMR versions before 8.5.0 contain a flaw where the Document::has_expired() function incorrectly checks document expiration times. This inverted comparison causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime, allowing indefinite access to expired bulk export files and CCDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenEMR versions prior to 8.5.0 by running: grep -r 'Document::has_expired' /var/www/html/openemr/library/classes/Document.class.php. If the comparison operator in has_expired() is >= instead of <=, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Authenticated users with proper authorization can download expired PHI documents indefinitely, bypassing the intended one-hour retention period. This exposes sensitive health information long after it should have been purged, potentially leading to unauthorized access and data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA's requirements for PHI access controls and retention periods, as it allows unauthorized access to expired documents. GDPR's data minimization and storage limitation principles may also be breached due to indefinite retention of expired PHI.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. If upgrading is not possible, modify the Document::has_expired() method in library/classes/Document.class.php to use <= instead of >= for the date comparison. Additionally, implement a scheduled purge task to remove expired documents where date_expires is <= current time.

Useful 0 Not Useful 0