OpenEMR Missing Authorization Vulnerability Exposes Patient Data

Executive Summary

OpenEMR versions before 8.5.0 have a missing authorization flaw in certain scripts. These scripts only check session authentication and do not verify user permissions via AclMain::aclCheckCore(). This allows any low-privilege authenticated user to access sensitive files like export_labworks.php, chart_tracker.php, or export_registry_xml.php.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to export_labworks.php, chart_tracker.php, or export_registry_xml.php in OpenEMR installations. Review server logs for requests to these scripts by low-privilege users. Verify if AclMain::aclCheckCore() is called in custom scripts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this to disclose patient data including SSN, date of birth, insurance details, or provider NPI and tax IDs. They could also forge chart-tracker records, potentially leading to data breaches or fraud.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information (PHI). GDPR requires strict access controls and breach notification, while HIPAA mandates safeguards for PHI. Exploitation could result in non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Ensure all custom scripts call AclMain::aclCheckCore() for proper authorization checks. Restrict access to sensitive scripts to authorized personnel only.

Useful 0 Not Useful 0