GHSA-rr38-hpxq-wwff: OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Which OpenEMR deployments are affected?
OpenEMR versions from 6.0.0 until 8.3.0 are affected. Version 8.3.0 fixes the issue.
Does exploitation require an account or user interaction?
No. A remote attacker can probe the login flow without authentication or user interaction.
What can an attacker learn from this issue?
An attacker can distinguish existing usernames from nonexistent ones through timing differences or visible page differences. The resulting account list may support later credential attacks.
How can defenders determine whether enumeration attempts may be occurring?
Review login-related activity for repeated unauthenticated requests using different authUser values, especially where an actor appears to be systematically testing usernames. The advisory does not provide specific log fields or detection signatures.