Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in OpenEMR allows authenticated users to extract sensitive patient data and user credentials through a weakness in the Fee Sheet functionality. This issue leverages the application's drug inventory lookup to perform time-based attacks.
- Low-privileged users can steal patient and user data.
- Patient data is at risk if systems are not secured.
- Confirm relevance and exposure for patient data systems.
Attack Path
How an attacker could exploit the issue
Attackers with low-level access to OpenEMR can exploit a vulnerability in the Fee Sheet feature. By submitting specially crafted product lines, they can manipulate database queries to exfiltrate sensitive patient information and user credentials.
- Requires authenticated user access.
- Manipulates `ORDER BY` clause with user input.
- Leads to patient data and credential theft.
Live Threat
Current exploitation, exposure, and threat context
Low-privileged authenticated users could exploit this vulnerability to extract sensitive patient data and user account credentials. When supported by the advisory, this could occur by crafting specific requests to the Fee Sheet functionality that manipulate database queries. The potential impact includes unauthorized access to protected health information and compromised user accounts.
- Patient data and user credentials could be exfiltrated.
- Malicious SQL queries could be injected.
- Unauthorized access to sensitive information.
Operational Fix
Recommended remediation, mitigation, and detection steps
The OpenEMR application owner and the platform team are likely responsible for addressing this critical SQL injection vulnerability. The first practical step is to identify all OpenEMR instances, confirm their internet reachability and business criticality, and then engage the accountable owner to prioritize and plan remediation, considering potential vendor coordination or temporary risk reduction measures.
- Confirm ownership of OpenEMR instances.
- Verify instance exposure and business criticality.
- Plan remediation based on confirmed risk.
