Summary
OpenHealth exposes health-data API handlers that process records by identifier without checking whether the requester is authenticated or authorized to access the record. An unauthenticated attacker who knows a record ID may read medical data and file metadata, modify stored content, or delete the record.
OpenHealth exposes health-data API handlers that process records by identifier without checking whether the requester is authenticated or authorized to access the record. An unauthenticated attacker who knows a record ID may read medical data and file metadata, modify stored content, or delete the record.
Affected context
The vulnerability occurs in OpenHealth deployments through version 0.2.0 where the /api/health-data/[id] GET, PATCH, and DELETE handlers accept a record identifier without consistently enforcing session and ownership checks. Risk is greatest when record IDs are discoverable, predictable, exposed through other application behavior, or otherwise obtainable by an unauthenticated user.
The vulnerability occurs in OpenHealth deployments through version 0.2.0 where the /api/health-data/[id] GET, PATCH, and DELETE handlers accept a record identifier without consistently enforcing session and ownership checks. Risk is greatest when record IDs are discoverable, predictable, exposed through other application behavior, or otherwise obtainable by an unauthenticated user.
Exploit preconditions
- Attack surface: The
/api/health-data/[id]HTTP endpoints - Required access: Network access to the API; no valid session may be required
- Trigger point: A GET, PATCH, or DELETE request targeting a known HealthData record ID
- Why exploitation is possible: The handlers query and modify records by identifier without verifying authentication or confirming that the requester is authorized to access the selected record
- Attack surface: The
/api/health-data/[id]HTTP endpoints - Required access: Network access to the API; no valid session may be required
- Trigger point: A GET, PATCH, or DELETE request targeting a known HealthData record ID
- Why exploitation is possible: The handlers query and modify records by identifier without verifying authentication or confirming that the requester is authorized to access the selected record
Why this happens
The underlying flaw is an authorization boundary failure in request handlers. The endpoints trust a client-supplied record identifier and perform database operations before establishing the requester's identity and ownership permissions. This maps primarily to CWE-306: Missing Authentication for Critical Function, with a related broken-access-control condition because authenticated identity and record-level authorization are not enforced before sensitive operations.
The underlying flaw is an authorization boundary failure in request handlers. The endpoints trust a client-supplied record identifier and perform database operations before establishing the requester's identity and ownership permissions. This maps primarily to CWE-306: Missing Authentication for Critical Function, with a related broken-access-control condition because authenticated identity and record-level authorization are not enforced before sensitive operations.
Potential impact
- An attacker may disclose another user's medical records and associated file metadata.
- An attacker could overwrite health-data records with arbitrary JSON.
- An attacker may delete records, causing loss of availability or integrity.
- The vulnerability could create privacy, compliance, and patient-safety risks.
- An attacker may disclose another user's medical records and associated file metadata.
- An attacker could overwrite health-data records with arbitrary JSON.
- An attacker may delete records, causing loss of availability or integrity.
- The vulnerability could create privacy, compliance, and patient-safety risks.
General mitigation guidance
Mitigation generally centers on enforcing identity and record-level authorization at every sensitive handler.
Common defensive patterns include:
- Require an authenticated session before processing health-data requests.
- Derive the user identity from a trusted server-side session or token rather than request parameters.
- Verify that the authenticated user or an explicitly authorized role owns or may access the requested record before every read, update, or delete operation.
- Apply deny-by-default authorization policies and use separate policies for viewing, editing, and deleting data.
- Prefer database queries that include the authorized subject or tenant constraint, reducing reliance on an identifier-only lookup.
- Minimize record and file-metadata exposure and apply least privilege to service accounts.
- Record and review access, modification, and deletion events without logging sensitive medical content.
Mitigation generally centers on enforcing identity and record-level authorization at every sensitive handler.
Common defensive patterns include:
- Require an authenticated session before processing health-data requests.
- Derive the user identity from a trusted server-side session or token rather than request parameters.
- Verify that the authenticated user or an explicitly authorized role owns or may access the requested record before every read, update, or delete operation.
- Apply deny-by-default authorization policies and use separate policies for viewing, editing, and deleting data.
- Prefer database queries that include the authorized subject or tenant constraint, reducing reliance on an identifier-only lookup.
- Minimize record and file-metadata exposure and apply least privilege to service accounts.
- Record and review access, modification, and deletion events without logging sensitive medical content.
How teams detect issues like this
Detection can combine application review, automated analysis, and runtime monitoring:
- Use static analysis and code review rules that flag database lookups keyed only by URL parameters in sensitive handlers.
- Review every GET, PATCH, and DELETE path for authentication middleware and object-level authorization checks.
- Look for controller or route code that accesses user-owned records before resolving the authenticated principal.
- Test requests with no session, a different user's session, invalid identifiers, and identifiers from another tenant.
- Enforce API policies requiring authentication and authorization annotations for protected health-data routes.
- Monitor for unusual unauthenticated requests, repeated identifier enumeration, bulk reads, unexpected updates, and deletion patterns.
Automated security testing and code-review tools may help identify missing checks, but findings should be validated against the application's authorization model.
Detection can combine application review, automated analysis, and runtime monitoring:
- Use static analysis and code review rules that flag database lookups keyed only by URL parameters in sensitive handlers.
- Review every GET, PATCH, and DELETE path for authentication middleware and object-level authorization checks.
- Look for controller or route code that accesses user-owned records before resolving the authenticated principal.
- Test requests with no session, a different user's session, invalid identifiers, and identifiers from another tenant.
- Enforce API policies requiring authentication and authorization annotations for protected health-data routes.
- Monitor for unusual unauthenticated requests, repeated identifier enumeration, bulk reads, unexpected updates, and deletion patterns.
Automated security testing and code-review tools may help identify missing checks, but findings should be validated against the application's authorization model.
