GHSA-w2f7-289j-92pp: OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments running versions before 8.5.0 are affected. Exploitation requires an authenticated user who can set a patient's External ID, and the stored payload affects other users when they open that patient's prescriptions using View Printable Version (HTML).
What must an attacker do to exploit the vulnerability?
The attacker must authenticate to OpenEMR and place a script payload in the patient External ID field. The script is triggered when another user views the affected patient's prescriptions in the HTML printable view.
What is the likely impact on a user who triggers the payload?
The script runs in the browser session of the user opening the printable prescription view. The available data indicates confidentiality impact within the vulnerable component and a scope change, but does not indicate integrity or availability impact.
How can administrators identify potentially affected records?
Review patient External ID values for unexpected script-like or HTML content, especially for patients whose prescriptions have been accessed through View Printable Version (HTML). The supplied information does not identify a specific detection query or log indicator.