OpenEMR Missing Authorization in Clinical Records

Executive Summary

OpenEMR before version 8.5.0 has a missing authorization vulnerability in authorizations_full.php. This flaw allows any authenticated staff user to authorize arbitrary patients' clinical records without proper checks. Attackers can send a crafted request with mode=authorize and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR logs for unusual requests to authorizations_full.php with mode=authorize parameters. Inspect database records in billing, forms, pnotes, and transactions tables for unauthorized authorized=1 entries. Monitor network traffic for GET requests to authorizations_full.php containing mode=authorize and CSRF tokens from non-provider users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized staff users to approve clinical records for any patient, potentially leading to falsified billing, unauthorized access to sensitive patient data, and removal of records from provider review queues. It compromises data integrity and confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA by allowing unauthorized access to and modification of patient records. It undermines data integrity, patient privacy, and audit controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Apply the missing authorization check from authorizations.php to authorizations_full.php. Restrict access to authorizations_full.php at the web server level. Disable the mode=authorize functionality if not required. Review and audit all authorized=1 entries in billing, forms, pnotes, and transactions tables.

Useful 0 Not Useful 0