Missing Authorization in OpenEMR Lets Authenticated Users Override Global Configurations

Executive Summary

OpenEMR before version 8.5.0 has a missing authorization flaw in library/ajax/user_settings.php. Any authenticated user can exploit this to override global configuration settings by sending POST requests with global:-prefixed keys. This allows attackers to redirect external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, enabling credential and PHI exfiltration.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.5.0 by running: grep -r 'openemr' /var/www/html/openemr/version.php or check the version in the web interface. Monitor POST requests to /library/ajax/user_settings.php for global:-prefixed keys like global:couchdb_host or global:smtp_host. Inspect the user_settings table in the OpenEMR database for unauthorized global overrides.

Useful 0 Not Useful 0

Impact Analysis

Attackers can steal system credentials and patient PHI by redirecting external service connections to their servers. They can also bypass security controls like facility isolation, disable audit logging, weaken password policies, expose PHP errors, and disable encryption for new data. The attack requires only a low-privilege account and no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access and exfiltration of protected health information (PHI), violating HIPAA requirements for safeguarding patient data. It may also result in GDPR non-compliance due to unauthorized data processing and potential breaches of personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Temporarily restrict write access to the user_settings.php endpoint or disable it if not essential. Review and remove any global:-prefixed keys in the user_settings table. Implement network monitoring to detect unauthorized external service connections.

Useful 0 Not Useful 0