Summary
OpenEMR's document write actions can reassign documents without first checking the caller's authorization for the source document and relevant patient or category. A low-privilege authenticated user may be able to move a document into a patient or category they can access, then retrieve it through the normal read path.
OpenEMR's document write actions can reassign documents without first checking the caller's authorization for the source document and relevant patient or category. A low-privilege authenticated user may be able to move a document into a patient or category they can access, then retrieve it through the normal read path.
Affected context
The issue occurs in OpenEMR document write actions in controllers/C_Document.class.php, including move_action_process(). Risk arises when the action calls Document::change_patient() before verifying access to the source document, current patient and category, and destination patient and category. A later HTTP 403 during list rendering does not necessarily mean the earlier mutation was prevented.
The issue occurs in OpenEMR document write actions in controllers/C_Document.class.php, including move_action_process(). Risk arises when the action calls Document::change_patient() before verifying access to the source document, current patient and category, and destination patient and category. A later HTTP 403 during list rendering does not necessarily mean the earlier mutation was prevented.
Exploit preconditions
- Attack surface: OpenEMR document write actions.
- Required access: An authenticated account with low privileges and the ability to invoke the relevant action.
- Trigger point: A document reassignment through an action such as
move_action_process(). - Relevant access: The user can access the destination patient or category where the document is reassigned.
- Why exploitation is possible: The document mutation can occur before authorization checks cover the source and destination resources.
- Attack surface: OpenEMR document write actions.
- Required access: An authenticated account with low privileges and the ability to invoke the relevant action.
- Trigger point: A document reassignment through an action such as
move_action_process(). - Relevant access: The user can access the destination patient or category where the document is reassigned.
- Why exploitation is possible: The document mutation can occur before authorization checks cover the source and destination resources.
Why this happens
The write path performs a document reassignment without first verifying that the caller is authorized for every affected object. This is an object-level authorization failure associated with CWE-639: Authorization Bypass Through User-Controlled Key. In general, an application must not rely on a supplied document or patient identifier as proof of access; it should authorize the requested operation against the source and destination before making changes.
The write path performs a document reassignment without first verifying that the caller is authorized for every affected object. This is an object-level authorization failure associated with CWE-639: Authorization Bypass Through User-Controlled Key. In general, an application must not rely on a supplied document or patient identifier as proof of access; it should authorize the requested operation against the source and destination before making changes.
Potential impact
- A user may reassign documents they are not authorized to manage.
- A document could become retrievable through a patient or category the user can access.
- Sensitive health information may be exposed to unauthorized users.
- Document records and their patient associations could be modified without proper authorization.
- A user may reassign documents they are not authorized to manage.
- A document could become retrievable through a patient or category the user can access.
- Sensitive health information may be exposed to unauthorized users.
- Document records and their patient associations could be modified without proper authorization.
General mitigation guidance
Mitigations generally focus on enforcing object-level authorization before any state change.
- Check access to the source document and its current patient and category before mutation.
- Independently authorize the destination patient and category.
- Perform authorization and mutation together in a controlled operation to reduce timing and consistency gaps.
- Derive resource access from trusted server-side identity and policy data rather than trusting submitted identifiers.
- Apply least privilege to user roles and keep read and write authorization checks consistent.
Mitigations generally focus on enforcing object-level authorization before any state change.
- Check access to the source document and its current patient and category before mutation.
- Independently authorize the destination patient and category.
- Perform authorization and mutation together in a controlled operation to reduce timing and consistency gaps.
- Derive resource access from trusted server-side identity and policy data rather than trusting submitted identifiers.
- Apply least privilege to user roles and keep read and write authorization checks consistent.
How teams detect issues like this
Review document write paths for mutations that occur before source and destination authorization checks. Static analysis and code review can look for object updates based on request-supplied identifiers without a nearby, explicit access-control decision. Test policies should verify that unauthorized reassignment is rejected before any state changes, including when the eventual response is an error. Automated review tools may help identify missing object-level authorization checks.
Review document write paths for mutations that occur before source and destination authorization checks. Static analysis and code review can look for object updates based on request-supplied identifiers without a nearby, explicit access-control decision. Test policies should verify that unauthorized reassignment is rejected before any state changes, including when the eventual response is an error. Automated review tools may help identify missing object-level authorization checks.
