Reflected XSS in OpenEMR Prior to 8.5.0

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. An authenticated attacker can inject JavaScript payloads via the searchEleNo POST parameter in the application/index/search endpoint. The input is echoed unencoded into HTML attributes and JavaScript contexts, allowing execution of arbitrary scripts in a victim's session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances for versions prior to 8.5.0. Check if the searchEleNo POST parameter in the application/index/search endpoint is reflected without proper encoding. Monitor network traffic for suspicious POST requests to this endpoint with JavaScript payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal non-HttpOnly session cookies and access patient data. The vulnerability requires an authenticated session and at least one matching patient record. Exploitation can occur through the standard patient search box, where manipulated input triggers the payload against other users sharing the same session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to patient data, violating HIPAA's confidentiality requirements. It may also result in data breaches, which are a major concern under GDPR, potentially leading to fines and legal consequences for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Apply input validation to restrict searchEleNo to digits only. Ensure output encoding for HTML attributes and JavaScript contexts. Set the HttpOnly flag on session cookies to prevent theft via document.cookie.

Useful 0 Not Useful 0