Cross-Site Request Forgery in OpenEMR Leads to Observation Deletion

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in OpenEMR versions before 8.5.0. It allows attackers to trick a logged-in clinician into visiting a malicious page that sends a GET request to delete.php with guessed observation record IDs. This soft-deletes observations in the victim's active encounter without requiring a CSRF token.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor OpenEMR logs for suspicious GET requests to delete.php with observation record IDs. Check for repeated failed deletion attempts or unusual patterns in observation records being soft-deleted without user action.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete patient observation records in your active encounter without your knowledge. This could lead to loss of critical medical data, incorrect patient records, or disruption of clinical workflows if observations are deleted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized deletion of patient records, violating integrity and availability requirements in GDPR and HIPAA. It may result in non-compliance with data integrity and audit trail provisions, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later to address the CSRF flaw. If immediate upgrade is not possible, implement network-level protections to block unauthorized GET requests to delete.php and review access logs for suspicious activity.

Useful 0 Not Useful 0