Stored XSS in OpenEMR Fee Sheet Notecodes Field

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. It exists in the Fee Sheet feature's notecodes field due to improper escaping. Attackers with clinician access can inject malicious JavaScript by exploiting unescaped single quotes, which executes when higher-privileged users view the Fee Sheet.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR versions prior to 8.5.0 for improperly escaped Fee Sheet notecodes fields. Check the file interface/forms/fee_sheet/new.php around line 306 for use of the text() function instead of attr() for the notecodes field. Verify if clinician accounts can inject payloads like ' onclick=alert(1) x=' that break out of HTML attribute contexts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with clinician access could steal sensitive data, perform unauthorized actions on behalf of higher-privileged users, or take control of their sessions. The impact crosses privilege boundaries as the injected script runs in browsers of administrators or other privileged users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI) under HIPAA or personal data under GDPR, potentially resulting in compliance violations, data breaches, and legal penalties due to insufficient protection against XSS attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later to address the improper escaping in the Fee Sheet notecodes field. If immediate upgrade is not possible, apply a patch to replace text() with attr() for the notecodes field in interface/forms/fee_sheet/new.php. Restrict clinician access to sensitive Fee Sheet editing until mitigation is complete.

Useful 0 Not Useful 0