Cross-site scripting in OpenEMR - #VU158835

Vulnerability details

The vulnerability allows a remote user to execute arbitrary JavaScript in an EOB user's authenticated OpenEMR session, disclose patient and financial information, and perform billing actions available to that user.

The vulnerability exists due to improper JavaScript-string escaping in interface/billing/sl_eob_invoice.php when rendering stored billing codes inside inline onkeyup handlers in the manual EOB payment form. A remote user can save a billing code such as x',alert(1),'y on an encounter they have permission to code, causing injected JavaScript to execute when an EOB user types in the charge's Pay field. HTML attribute escaping converts quotes to ', but the browser decodes these entities before compiling the handler, allowing the quotes to terminate the intended JavaScript strings.

Affected software

Remediation

External References

• https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3

Related Security Bulletins

• Multiple vulnerabilities in OpenEMR