GHSA-xgxv-36g2-hq5g: OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download
OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can upload a document containing an absolute pathname, such as the sqlconf.php location, then download it to read server files and recover database credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR user needs both document upload and document download access. The issue is therefore most relevant where these permissions are granted to users who should not be able to read arbitrary files from the server.
What does an attacker need to do to read a server file?
The attacker uploads a document whose contents are an absolute filesystem path to a target file, then downloads that document through the REST document download functionality. If the application can access the referenced file, its contents are returned instead of the uploaded document content.
What is the potential impact of successful exploitation?
An attacker can read arbitrary local files accessible to the OpenEMR process. The advisory specifically identifies sqlconf.php as a target that can expose database credentials.
How can I remediate the issue?
Upgrade OpenEMR to version 8.4.0 or later. The affected versions are OpenEMR releases before 8.4.0.