Arbitrary file upload in OpenEMR - #VU158846

Vulnerability details

The vulnerability allows a remote user to execute arbitrary PHP code as the OpenEMR web-server user.

The vulnerability exists due to unrestricted upload of files containing executable PHP in OpenEMR's ERA upload handler when processing malformed ERA files, which are retained despite parsing errors at the predictable path sites/default/documents/era/.edi. A remote user can upload a malicious ERA file with acct/bill or acct/eob write permission and, using a separate database-write primitive, modify the background_services registry to have BackgroundServiceRunner load the uploaded file through require_once to execute arbitrary PHP code.

Affected software

Remediation

External References

• https://github.com/openemr/openemr/security/advisories/GHSA-r6wm-8m2j-c3q9

Related Security Bulletins

• Multiple vulnerabilities in OpenEMR