GHSA-9rj4-fxmj-c4r7: OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke CX12Partner::editactionprocess() to create or alter insurance-routing hosts and credentials, or invoke CPatientFinder::findactionprocess() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated OpenEMR user can exploit it. The attack is network-accessible and does not require user interaction.
Which deployments are affected?
OpenEMR versions prior to 8.3.0 are affected. The vulnerable behavior is in explicit controller.php dispatch for controllers missing from CONTROLLER_ACL_MAP, where ACL enforcement fails open.
What could an attacker do?
An authenticated low-privilege user can create or modify insurance-routing hosts and credentials through C_X12Partner::edit_action_process(). They can also use C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers; other intended ACL-gated administrative controllers may also be exposed.
How can I determine whether an instance is exposed?
Check whether the OpenEMR installation is running a version earlier than 8.3.0. Review whether low-privilege accounts can directly invoke controller.php endpoints for C_X12Partner or C_PatientFinder, and audit insurance-routing configuration changes and patient-search activity for unexpected use.
What should be done if patching cannot happen immediately?
Restrict or disable low-privilege authenticated access where feasible, especially for accounts that do not require access to administrative or patient-search functionality. Monitor and review insurance-routing hosts and credentials for unauthorized changes, and investigate unusual patient enumeration activity.