Multiple Vulnerabilities Found In Healthcare Software OpenEMR

Scientists have identified 3 separate vulnerabilities in OpenEMR, an open-resource software package for electronic health and fitness documents and health care observe administration.

Cleanse code experts at Sonar posted an advisory Wednesday about the discovered flaws by security researcher Dennis Brinkrolf.

“During our security analysis of well-known web programs, we discovered quite a few code vulnerabilities in OpenEMR,” Brinkrolf wrote.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“A mixture of these vulnerabilities permits remote attackers to execute arbitrary program instructions on any OpenEMR server and to steal sensitive client info. In the worst scenario, they can compromise the whole critical infrastructure.”

The security skilled stated that the company’s static application security screening (SAST) motor uncovered that two of these 3 vulnerabilities combined could lead to unauthenticated remote code execution (RCE).

“In summary, an attacker can use the mirrored XSS, add a PHP file […] and then use the route traversal by way of the Nearby File Inclusion to execute the PHP file. It takes a couple attempts to determine out the ideal Unix timestamp but inevitably prospects to distant code execution.”

As for the third vulnerability, it authorized attackers to configure OpenEMR in a sure way in order to ultimately steal consumer data.

“In other text, if OpenEMR is established up properly, an unauthenticated attacker can go through files like certificates, passwords, tokens, and backups from an OpenEMR occasion by means of a rogue MySQL server,” Brinkrolf stated.

The security researcher included that Sonar described all issues to the OpenEMR maintainers on October 24, 2022, who then produced a patch to edition 7.., fixing all 3 vulnerabilities 7 times afterwards.

“If you are employing OpenEMR, we strongly recommend updating to the mounted versions mentioned previously mentioned,” the Sonar article concluded. “We want to thank the OpenEMR team for their expert and rapidly responses and patches.”

The patched vulnerabilities arrive pretty much five a long time right after scientists at Challenge Insecurity observed about 20 flaws (now fastened) in OpenEMR.