Executive Summary

[{'type': 'paragraph', 'content': "The vulnerability in OpenEMR prior to version 8.0.0 involves missing authorization checks in certain REST API routes related to patient documents and insurance data. Specifically, the routes handling these resources did not call the function responsible for enforcing Access Control List (ACL) permissions, allowing any valid API bearer token to access or modify all patients' documents and insurance information regardless of the token's assigned permissions."}, {'type': 'paragraph', 'content': 'This means that API endpoints such as those for adding, retrieving, or modifying patient documents and insurance data were accessible without proper authorization validation, exposing sensitive patient health information (PHI) and insurance details to unauthorized users who possess any valid API token.'}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts by allowing unauthorized access and modification of sensitive patient documents and insurance data. Any authenticated API client with a valid bearer token, even with minimal permissions, can read, upload, or alter protected health information (PHI) and insurance details for any patient.

• Unauthorized reading of all patient documents and insurance data.
• Unauthorized modification or uploading of patient documents.
• Unauthorized swapping or changing of insurance assignments.

This exposure can lead to privacy breaches, data integrity issues, and potential misuse of sensitive medical and financial information.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring API calls to the affected OpenEMR REST API endpoints that handle patient documents and insurance data without proper authorization checks.'}, {'type': 'paragraph', 'content': 'Specifically, suspicious or unauthorized access can be identified by checking for API requests using valid bearer tokens to the following endpoints:'}, {'type': 'list_item', 'content': 'GET /api/patient/<patient_id>/document?path=/ (listing documents)'}, {'type': 'list_item', 'content': 'GET /api/patient/<patient_id>/document/<document_id> (downloading documents)'}, {'type': 'list_item', 'content': 'POST /api/patient/<patient_id>/document (adding or modifying documents)'}, {'type': 'list_item', 'content': 'GET /api/patient/<patient_uuid>/insurance (retrieving insurance data)'}, {'type': 'list_item', 'content': 'GET /api/patient/<patient_uuid>/insurance/$swap-insurance?type=primary&uuid=<insurance_uuid> (swapping insurance assignments)'}, {'type': 'paragraph', 'content': 'Commands to detect exploitation attempts could include inspecting web server or API gateway logs for these endpoints accessed with bearer tokens, for example using grep or similar tools:'}, {'type': 'list_item', 'content': "grep -i 'GET /api/patient/.*/document' /var/log/openemr_access.log"}, {'type': 'list_item', 'content': "grep -i 'POST /api/patient/.*/document' /var/log/openemr_access.log"}, {'type': 'list_item', 'content': "grep -i 'GET /api/patient/.*/insurance' /var/log/openemr_access.log"}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unusual or unauthorized bearer tokens accessing these endpoints can help detect exploitation.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenEMR to version 8.0.0 or later, where the missing authorization checks have been added to the affected REST API routes.

If upgrading immediately is not possible, consider disabling or restricting access to the vulnerable API endpoints related to patient documents and insurance data until a patch can be applied.

Additionally, review and restrict API bearer tokens to only trusted clients and monitor API usage closely for suspicious activity.

Applying network-level controls such as firewall rules or API gateway policies to limit access to these endpoints can also reduce risk.

Useful 0 Not Useful 0