Information Disclosure in OpenEMR via Debug Code

Executive Summary

This vulnerability in OpenEMR versions before 8.5.0 involves active debug code in the file interface/fax/fax_view.php. When a fax job file cannot be opened, the code executes the Unix 'groups' command and displays the web server's group memberships to the browser. Authenticated attackers with fax module access can exploit this by providing a non-existent jid value to reveal sensitive group information like 'adm' or 'shadow'.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if OpenEMR versions before 8.5.0 are installed. Exploit attempts may involve accessing the fax module with a non-existent jid value in the URL, such as ?jid=NOTEXIST. Review server logs for passthru('groups') execution or group information disclosure in responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers with fax module access to gather sensitive system information, such as Unix group memberships. This information can aid in planning privilege escalation attacks, potentially leading to unauthorized access or further system compromise. The impact is limited to information disclosure and requires authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later to remove the debug code. Remove or disable the fax_view.php debug functionality if upgrading is not immediately possible. Restrict access to the fax module to trusted users only.

Useful 0 Not Useful 0