Improper Authentication in OpenEMR via OAuth2 Dynamic Client Registration

Executive Summary

OpenEMR versions through 8.2.0 have an improper authentication flaw in the OAuth2 dynamic client registration endpoint. Unauthenticated attackers can register a malicious client with system-level FHIR scopes by providing a self-generated RSA keypair via the jwks field. If an administrator approves this client, attackers can then use client_credentials grant with a self-signed JWT to obtain access tokens granting read access to all FHIR resources across all patients.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR logs for suspicious OAuth2 client registration attempts, particularly those with self-generated RSA keypairs in the jwks field. Inspect network traffic for client_credentials grant requests using self-signed JWT assertions.

Useful 0 Not Useful 0

Impact Analysis

Attackers could gain unauthorized read access to all patient FHIR resources in the system, potentially exposing sensitive health information. This could lead to data breaches, privacy violations, and unauthorized access to confidential medical records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to protected health information. GDPR requires strict data protection and breach notification, while HIPAA mandates safeguards for patient data. A breach could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable OAuth2 dynamic client registration in OpenEMR if not required. Review and revoke any unauthorized client registrations. Update OpenEMR to the latest version beyond 8.2.0 to address the improper authentication flaw.

Useful 0 Not Useful 0