Session Hijacking in epa4all via TLS Interception

Executive Summary

This vulnerability exists in the epa4all software before version 2026-05-20. An attacker can intercept the TLS connection between epa4all and the ePA backend. By using attacker-controlled keys, the attacker can complete the VAU handshake and obtain session encryption keys. This allows the attacker to read and modify all inner HTTP traffic, including patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries. The attacker can also inject arbitrary requests through the hijacked channel.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a man-in-the-middle attack on TLS connections between epa4all and the ePA backend. Detection requires monitoring for unexpected TLS handshake anomalies or unauthorized session key exposure. Check for unusual network traffic patterns or unexpected certificate validations. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use epa4all prior to version 2026-05-20, an attacker could access and modify sensitive data such as patient consent decisions, medication records, and authorization tokens. They could also perform unauthorized actions by injecting requests. This could lead to privacy breaches, data theft, or unauthorized system access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access and potential exposure of sensitive personal and medical data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Update epa4all to version 2026-05-20 or later to patch the vulnerability. Ensure all TLS connections between epa4all and the ePA backend are properly validated and encrypted. Monitor network traffic for unauthorized TLS handshake attempts or session hijacking activities.

Useful 0 Not Useful 0