OpenEMR Two-Factor Authentication Bypass via Brute-Force

Executive Summary

OpenEMR versions before 8.5.0 do not implement rate limiting or account lockout for TOTP (Time-based One-Time Password) submissions. This allows attackers with a valid password to repeatedly attempt brute-forcing the 6-digit MFA code. Attackers can automate POST requests to main_screen.php or abuse the OAuth2 authorization flow by resubmitting hidden credentials to bypass two-factor authentication.

Useful 0 Not Useful 0

Detection Guidance

Monitor repeated POST requests to main_screen.php or OAuth2 authorization endpoints. Check for multiple failed TOTP attempts within a short timeframe, which may indicate brute-force attempts against the 6-digit MFA code.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenEMR before version 8.5.0, an attacker with your password could bypass MFA and gain unauthorized access to your account. This could lead to data breaches, unauthorized modifications, or theft of sensitive information stored in OpenEMR.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI) under HIPAA or personal data under GDPR. Organizations using vulnerable OpenEMR versions may fail to meet security requirements for access controls, potentially resulting in compliance violations, fines, or legal liabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later to address the lack of rate limiting. Implement account lockout policies after a few failed TOTP attempts. Consider additional MFA enforcement or IP-based rate limiting as temporary measures.

Useful 0 Not Useful 0