Summary
OpenEMR's fax module stages decrypted patient documents in a location that can be reached through a public URL, and the files are not removed afterward. An unauthenticated network actor who obtains or guesses a URL may retrieve sensitive documents, including when drive encryption is enabled.
OpenEMR's fax module stages decrypted patient documents in a location that can be reached through a public URL, and the files are not removed afterward. An unauthenticated network actor who obtains or guesses a URL may retrieve sensitive documents, including when drive encryption is enabled.
Affected context
The issue occurs in OpenEMR's SignalWire fax workflow, where a selected patient document is decrypted and written as plaintext under sites/{siteId}/fax before being sent to SignalWire. The staged file is exposed through a returned public URL, its filename is based on predictable uniqid() values, and it is not removed after use. Risk depends on the URL being reachable and an actor obtaining or guessing it.
The issue occurs in OpenEMR's SignalWire fax workflow, where a selected patient document is decrypted and written as plaintext under sites/{siteId}/fax before being sent to SignalWire. The staged file is exposed through a returned public URL, its filename is based on predictable uniqid() values, and it is not removed after use. Risk depends on the URL being reachable and an actor obtaining or guessing it.
Exploit preconditions
- Attack surface: The URL serving files staged under the fax directory
- Required access: No OpenEMR authentication is required if an actor can reach and obtain or guess the URL
- Trigger point: A fax workflow stages a selected patient document and returns its URL
- Why exploitation is possible: The document is written in plaintext to a publicly retrievable location, with a predictable filename and no subsequent cleanup
- Attack surface: The URL serving files staged under the fax directory
- Required access: No OpenEMR authentication is required if an actor can reach and obtain or guess the URL
- Trigger point: A fax workflow stages a selected patient document and returns its URL
- Why exploitation is possible: The document is written in plaintext to a publicly retrievable location, with a predictable filename and no subsequent cleanup
Why this happens
The fax workflow creates a publicly reachable copy of a sensitive document without sufficient access controls or lifecycle cleanup. This maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-552: Files or Directories Accessible to External Parties. Encryption at rest does not protect a document after the application decrypts it and writes plaintext to an exposed location.
The fax workflow creates a publicly reachable copy of a sensitive document without sufficient access controls or lifecycle cleanup. This maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-552: Files or Directories Accessible to External Parties. Encryption at rest does not protect a document after the application decrypts it and writes plaintext to an exposed location.
Potential impact
- Unauthorized parties may access patient records and other sensitive document contents
- Patient privacy and confidentiality could be compromised
- Exposed information may be retained, copied, or shared beyond the original fax transaction
- Healthcare organizations could face compliance, operational, or reputational consequences
- Unauthorized parties may access patient records and other sensitive document contents
- Patient privacy and confidentiality could be compromised
- Exposed information may be retained, copied, or shared beyond the original fax transaction
- Healthcare organizations could face compliance, operational, or reputational consequences
General mitigation guidance
Common defensive patterns focus on limiting the exposure and lifetime of staged files:
- Keep temporary documents outside publicly served directories and deny direct network access by default
- Require authorization for document retrieval, or use narrowly scoped, short-lived access tokens where external access is necessary
- Treat filenames as identifiers, not as access controls; avoid relying on predictability or obscurity for confidentiality
- Remove staged plaintext files promptly after delivery or failure, with safeguards for cleanup errors
- Minimize plaintext handling and restrict the process and storage location to least privilege
- Validate that encryption and access controls cover temporary copies as well as original documents
Common defensive patterns focus on limiting the exposure and lifetime of staged files:
- Keep temporary documents outside publicly served directories and deny direct network access by default
- Require authorization for document retrieval, or use narrowly scoped, short-lived access tokens where external access is necessary
- Treat filenames as identifiers, not as access controls; avoid relying on predictability or obscurity for confidentiality
- Remove staged plaintext files promptly after delivery or failure, with safeguards for cleanup errors
- Minimize plaintext handling and restrict the process and storage location to least privilege
- Validate that encryption and access controls cover temporary copies as well as original documents
How teams detect issues like this
- Review code paths that decrypt sensitive files and write them to web-accessible directories
- Use static analysis and code review checks to flag public URL generation, predictable temporary filenames, and missing cleanup
- Monitor web and application logs for requests to fax staging paths, especially unauthenticated access or repeated filename probing
- Apply deployment policies that prevent sensitive temporary files from being served directly
- Include tests that verify staged documents require authorization and are removed after their intended use
- Review code paths that decrypt sensitive files and write them to web-accessible directories
- Use static analysis and code review checks to flag public URL generation, predictable temporary filenames, and missing cleanup
- Monitor web and application logs for requests to fax staging paths, especially unauthenticated access or repeated filename probing
- Apply deployment policies that prevent sensitive temporary files from being served directly
- Include tests that verify staged documents require authorization and are removed after their intended use
