GHSA-xhv3-qr55-56h3: OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials(). When the Weno module is enabled, the default GET path calls PharmacyService::removeWenoPharmacies() before attempting a refetch, allowing any authenticated user to truncate the wenopharmacy table and allowing a cross-site request to trigger the same operation through a logged-in victim. A failed later download can leave the e-prescribing pharmacy directory empty and unavailable. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenEMR deployments running versions before 8.3.0 are exposed when the Weno module is enabled. The affected endpoint is interface/modules/custom_modules/oe-module-weno/scripts/file_download.php.
What does an attacker need to trigger the problem?
Any authenticated OpenEMR user can trigger the pharmacy-directory removal because the endpoint does not enforce ACL checks. A separate authenticated account with administrative privileges is not required.
Can this be exploited through a logged-in user's browser?
Yes. The endpoint lacks CSRF protection, so a cross-site request can cause the operation when it is made through a logged-in victim's browser.
What is the operational impact if the later download fails?
The endpoint removes Weno pharmacy records before attempting to refetch them. If that later download fails, the weno_pharmacy table can remain empty, leaving the e-prescribing pharmacy directory unavailable.
What is the available remediation?
Upgrade OpenEMR to version 8.3.0, which fixes the issue.