DOM-based Cross-Site Scripting (XSS) in OpenEMR 7.0.0 and below at White list files in openemr/openemr


Reported on

Jul 22nd 2022


We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 (latest version) and below version; Open Source electronic health records and medical practice management application; has DOM-based Cross-Site Scripting (XSS) vulnerability in the add-manually-input field on white list file page that never been reported before (We've checked from CVE Official website).

Vulnerability Type

DOM-based Cross-Site Scripting (XSS)

Affected Page/URL


Sample XSS Payload


Vulnerable Source Code

/var/www/localhost/htdocs/openemr/interface/super/manage_site_files.php (Please see more details in the occurrences section)


Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction.

Unlike traditional Cross-Site Scripting (XSS), where the client is able to inject scripts into a request and have the server return the script to the client, DOM XSS does not require that a request be sent to the server and may be abused entirely within the loaded page.

This occurs when elements of the DOM (known as the sources) are able to be manipulated to contain untrusted data, which the client-side scripts (known as the sinks) use or execute an unsafe way.

Scanner has discovered that by inserting an HTML element into the page's DOM inputs (sources), it was possible to then have the HTML element rendered as part of the page by the sink.


Client-side document rewriting, redirection, or other sensitive action, using untrusted data, should be avoided wherever possible, as these may not be inspected by server side filtering.

To remedy DOM XSS vulnerabilities where these sensitive document actions must be used, it is essential to

  • Ensure any untrusted data is treated as text, as opposed to being interpreted as code or mark-up within the page.
  • Escape untrusted data prior to being used within the page. Escaping methods will vary depending on where the untrusted data is being used. (See references for details.)
  • Use document.createElement, element.setAttribute, element.appendChild, etc. to build dynamic interfaces as opposed to HTML rendering methods such as document.write, document.writeIn, element.innerHTML, or element.outerHTMLetc.


  • Ammarit Thongthua, Rattapon Jitprajong and Nattakit Intarasorn from Secure D Center Research Team

Example PoC Screenshots

OpenEMR Version 6.1.0


OpenEMR Version 7.0.0


Admin > System > Files


At the White list we Injected malicious JavaScript Payload in to {add-manually-input} with Sample XSS Payload



Renderred Malicious JavaScript (XSS)



DOM-based vulnerabilities arise when a website contains JavaScript that takes an attacker-controllable value, known as a source, and passes it into a dangerous function, known as a sink.


        $('#add-manually').on('click', function () {
            var new_type = $("#add-manually-input").val();
            if(new_type.length < 1)return;
            $('#white-list').prepend("<option value="+new_type+">"+new_type+"</option>")
We are processing your report and will contact the openemr team within 24 hours. a year ago
JohnNattakit modified the report
a year ago
We have contacted a member of the openemr team and are waiting to hear back a year ago
Brady Miller validated this vulnerability a year ago

Thanks for the report. We are working on a fix.

JohnNattakit has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
We have sent a fix follow up to the openemr team. We will try again in 7 days. a year ago
Brady Miller
a year ago


A preliminary fix has been posted in commit 74d21039aec641b2c406e3baf238ae4602a968b6

Please do not create a CVE # or make this vulnerability public at this time. I will make this fix official about 1 week after we release 7.0.0 patch 1 (, which will likely be in about 3-7 weeks. After I do that, then will be ok to make CVE # and make it public.


We have sent a second fix follow up to the openemr team. We will try again in 10 days. a year ago
a year ago


Dear @Brady Miller, @admin

Hope you are doing well. We have got the notification email that the 1st patch for OpenEMR 7.0.0 has been released.

Can the CVE be assigned to this issue?


Jamie Slome
a year ago


Just waiting on the go-ahead from the maintainer, then I can arrange and publish the CVE πŸ‘

Brady Miller marked this as fixed in with commit 74d210 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
Brady Miller
a year ago


OpenEMR patch 1 ( has been released, so this has been fixed. You have permission to make CVE # and make this public.

a year ago


Dear @Admin, @Jamie Slome Could you please help to assign the CVE for this finding please? Thanks and appreciate for your help πŸ‘

@Brady Miller Thanks for your response πŸ‘

Jamie Slome
a year ago


CVE assigned and will be automatically published in the next couple of hours πŸ‘ β™₯️

a year ago


@Jamie Slome Appreciate for your contribution πŸ‘β™₯️

to join this conversation