Summary
WeGIA contains a stored cross-site scripting vulnerability in the medical-record history feature because the textoProntuario field may accept and later render attacker-controlled HTML or JavaScript without adequate sanitization.
An attacker who can create or modify a patient's medical record may cause script execution in another user's browser when that user views the affected history, potentially exposing session data or enabling actions under the victim's privileges.
WeGIA contains a stored cross-site scripting vulnerability in the medical-record history feature because the textoProntuario field may accept and later render attacker-controlled HTML or JavaScript without adequate sanitization.
An attacker who can create or modify a patient's medical record may cause script execution in another user's browser when that user views the affected history, potentially exposing session data or enabling actions under the victim's privileges.
Affected context
The issue occurs in WeGIA deployments where medical-record content is submitted through the health-record management workflow and later displayed in the medical history page. Risk is higher when users with different privilege levels view shared patient records and when record content is rendered without context-appropriate output encoding or sanitization.
The issue occurs in WeGIA deployments where medical-record content is submitted through the health-record management workflow and later displayed in the medical history page. Risk is higher when users with different privilege levels view shared patient records and when record content is rendered without context-appropriate output encoding or sanitization.
Exploit preconditions
- Attack surface: Web-based medical-record creation or modification functionality
- Required access: Ability to create or access a patient's medical record and submit record text
- Trigger point: Another user viewing the affected medical history page
- Why exploitation is possible: Stored record content is rendered in a browser without sufficient sanitization or output encoding, allowing browser-interpreted markup or script to execute in the viewer's session
- Attack surface: Web-based medical-record creation or modification functionality
- Required access: Ability to create or access a patient's medical record and submit record text
- Trigger point: Another user viewing the affected medical history page
- Why exploitation is possible: Stored record content is rendered in a browser without sufficient sanitization or output encoding, allowing browser-interpreted markup or script to execute in the viewer's session
Why this happens
The vulnerability results from treating user-controlled medical-record text as trusted display content. The application stores the textoProntuario value and later inserts it into an HTML response without applying an appropriate allowlist-based sanitizer or context-aware output encoding.
This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically the stored variant in which malicious content persists on the server and executes when subsequently rendered for other users.
The vulnerability results from treating user-controlled medical-record text as trusted display content. The application stores the textoProntuario value and later inserts it into an HTML response without applying an appropriate allowlist-based sanitizer or context-aware output encoding.
This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically the stored variant in which malicious content persists on the server and executes when subsequently rendered for other users.
Potential impact
- Attacker-controlled JavaScript may execute in a victim's browser
- Session identifiers or other browser-accessible data could be exposed
- Victim actions may be performed using the victim's privileges
- Privileged user accounts could be compromised
- Medical-record views or related application data could be altered or accessed
- Attacker-controlled JavaScript may execute in a victim's browser
- Session identifiers or other browser-accessible data could be exposed
- Victim actions may be performed using the victim's privileges
- Privileged user accounts could be compromised
- Medical-record views or related application data could be altered or accessed
General mitigation guidance
Mitigation generally focuses on treating all submitted record content as untrusted and ensuring it cannot become executable browser content.
Common defensive patterns include:
- Applying context-aware output encoding whenever record text is rendered
- Using a narrowly defined HTML allowlist only when formatted content is genuinely required
- Sanitizing content with a well-maintained, security-focused library
- Avoiding direct insertion of user-controlled values into HTML, script, style, or event-handler contexts
- Enforcing server-side validation in addition to client-side checks
- Applying restrictive Content Security Policy controls as defense in depth
- Limiting session privileges and using secure cookie attributes to reduce potential impact
Mitigation generally focuses on treating all submitted record content as untrusted and ensuring it cannot become executable browser content.
Common defensive patterns include:
- Applying context-aware output encoding whenever record text is rendered
- Using a narrowly defined HTML allowlist only when formatted content is genuinely required
- Sanitizing content with a well-maintained, security-focused library
- Avoiding direct insertion of user-controlled values into HTML, script, style, or event-handler contexts
- Enforcing server-side validation in addition to client-side checks
- Applying restrictive Content Security Policy controls as defense in depth
- Limiting session privileges and using secure cookie attributes to reduce potential impact
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules for unencoded database values reaching HTML responses
- Code review checks for direct template interpolation, unsafe DOM insertion, and incomplete sanitization
- Testing stored user-input fields with harmless marker strings and browser-context validation
- Dynamic application testing of record creation and history-viewing workflows
- Policy enforcement requiring centralized output-encoding or sanitization helpers
- Monitoring for unexpected script-like content in medical-record fields and related audit events
Detection approaches commonly include:
- Static analysis rules for unencoded database values reaching HTML responses
- Code review checks for direct template interpolation, unsafe DOM insertion, and incomplete sanitization
- Testing stored user-input fields with harmless marker strings and browser-context validation
- Dynamic application testing of record creation and history-viewing workflows
- Policy enforcement requiring centralized output-encoding or sanitization helpers
- Monitoring for unexpected script-like content in medical-record fields and related audit events
