Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in OpenMRS Core allows an authenticated user to upload a specially crafted file, potentially overwriting critical system files and enabling remote code execution. This bypasses existing security measures, making it a significant risk for any organization using the affected versions of this electronic medical record system.
- Allows arbitrary file writes.
- Can lead to full system compromise.
- Bypasses existing security controls.
Attack Path
How an attacker could exploit the issue
An authenticated attacker with module upload privileges can exploit this flaw to execute arbitrary code. They can craft a malicious ZIP archive containing a JSP file with a path traversal payload, uploading it via the module endpoint. This allows them to write the JSP file to the web application root, enabling remote code execution when accessed through a browser.
- Requires authenticated access.
- Targets module upload endpoint.
- Uploads crafted ZIP archive.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows an authenticated attacker with module upload privileges to achieve remote code execution by uploading a malicious JSP file. The exploit is particularly concerning because it bypasses a runtime property intended to restrict web-based module administration, making even secured deployments vulnerable through the REST API. The context of an electronic medical record system suggests sensitive data is at risk.
- Exploitation requires authentication.
- No known public exploit.
- KEV unlikely due to required authentication.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or upgrading OpenMRS Core to versions 2.7.9+ or 2.8.6+ to address the critical Zip Slip vulnerability. If immediate patching is not feasible, restrict access to the module upload endpoint and monitor for suspicious file uploads or execution attempts.
- Upgrade OpenMRS to patched versions.
- Isolate or restrict module upload access.
- Monitor for anomalous file activity.
