3 Cybersecurity Vulnerabilities in OpenEMR Can Lead to Remote Code Execution

Three cybersecurity vulnerabilities in an older version of OpenEMR may leave healthcare organizations open to cyberattacks, HHS warned. HHS urged healthcare organizations using versions of OpenEMR lower than 7.0.0 to immediately apply a patch to prevent exploitation.

OpenEMR is one of the most common EHR systems, used by more than 100,000 medical providers. Software development solution company Sonar discovered the vulnerabilities and released a detailed report.

The three vulnerabilities, Unauthenticated File Read, Authenticated Local File Inclusion, and Authenticated Reflected XSS, may be used in combination by threat actors to remotely execute arbitrary system commands and steal patient information, Sonar stated.

“In the worst case, they can compromise the entire critical infrastructure,” the report added.

Sonar’s report contains technical details and attack lifecycle information for all three vulnerabilities. Specifically, researchers exemplified how a threat actor could leverage a MySQL configuration that could lead to an arbitrary file read.

“We also demonstrated how combining two code vulnerabilities, Cross-Site Scripting, and Local File Inclusion both detected by our SAST engine, can lead to a takeover of any OpenEMR instance,” Sonar continued. “Furthermore, we discussed the patches and showed how to prevent such issues in your PHP code.”

Sonar notified OpenEMR of the vulnerabilities in October. OpenEMR quickly released patches and hardened the application.