Missing Authentication for Critical Function in OpenEMR - #VU158843

Vulnerability details

The vulnerability allows a remote user to remove a target account's registered MFA factors without re-entering the account password, leaving the account protected by its password alone.

The vulnerability exists due to missing re-authentication for a critical function in OpenEMR's interface/usergroup/mfa_registrations.php when processing MFA factor deletion requests. A remote user can use a compromised authenticated session and a valid CSRF token to submit deletion requests for all of the account's TOTP and U2F registrations to disable its MFA protection.

Subsequent sign-ins still require the account password, and the changes are limited to the account associated with the compromised session.

Affected software

Remediation

External References

• https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh

Related Security Bulletins

• Multiple vulnerabilities in OpenEMR