GHSA-h5hw-xfj8-vgrv: OpenEMR: Patient Data Search Without Sufficient ACL
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege OpenEMR user can exploit it. The user does not need normal permission to access patient data, but must be able to establish an authenticated session.
What information can be exposed?
The MedEx SMS search endpoint can return patient identifiers, names, phone numbers, SMS permission status, and recent message information.
Are default access controls sufficient to prevent exploitation?
No. The affected sms_search functionality requires authentication but, before 8.3.0, does not enforce patient-level or feature-level ACLs for this request.
How can I determine whether my deployment is affected?
Deployments running OpenEMR before 8.3.0 are affected. Review access to the sms_search branch in interface/main/messages/save.php and investigate whether low-privilege accounts have used the MedEx SMS search endpoint.
What should be done if immediate patching is not possible?
Restrict or disable access to the MedEx SMS search functionality for low-privilege users, and limit authenticated access to trusted accounts until OpenEMR can be updated to 8.3.0.