Improper Privilege Management - receptionist can view background services and log for admin in openemr/openemr

Valid

Reported on

Apr 23rd 2022

Description

Hi there openemr maintainers, I would like to report an improper authorization vulnerability in your source code.

Proof of Concept

Install openemr in your system and create an admin account and a receptionist account
Log in as receptionist and see that you don't see Reports > Services in your menu, since you don't have privilege to do so
However, go to this link /openemr/interface/reports/background_services.php and see that you can view all background services. Go to this link /openemr/interface/reports/direct_message_log.php and you can view all direct message logs

Impact

Allowing receptionist to view all services reports and logs.

We are processing your report and will contact the openemr team within 24 hours. a year ago

We have contacted a member of the openemr team and are waiting to hear back a year ago

We have sent a follow up to the openemr team. We will try again in 7 days. a year ago

A openemr/openemr maintainer validated this vulnerability a year ago

justinp09010 has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

A openemr/openemr maintainer

commented a year ago

Maintainer

A preliminary fix for this has been placed in our development codebase at https://github.com/openemr/openemr/commit/d68a1e54e40ec5ce8d9ed3da0627f50b605d7216 The fix will officially be released in the next OpenEMR 6.1.0 patch 2 (6.1.0.2). After we release this patch, I will then mark this item as fixed (probably in about a month).

We have sent a fix follow up to the openemr team. We will try again in 7 days. a year ago

We have sent a second fix follow up to the openemr team. We will try again in 10 days. a year ago

We have sent a third and final fix follow up to the openemr team. This report is now considered stale. a year ago

A openemr/openemr maintainer marked this as fixed in 7.0.0 with commit d68a1e 10 months ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

A openemr/openemr maintainer

commented 10 months ago

Maintainer

This fix was included in OpenEMR version 7.0.0, which was recently released.

to join this conversation

We are processing your report and will contact the openemr team within 24 hours. a year ago

We have contacted a member of the openemr team and are waiting to hear back a year ago

We have sent a follow up to the openemr team. We will try again in 7 days. a year ago

A openemr/openemr maintainer validated this vulnerability a year ago

justinp09010 has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

A openemr/openemr maintainer

commented a year ago

Maintainer

We have sent a fix follow up to the openemr team. We will try again in 7 days. a year ago

We have sent a second fix follow up to the openemr team. We will try again in 10 days. a year ago

We have sent a third and final fix follow up to the openemr team. This report is now considered stale. a year ago

A openemr/openemr maintainer marked this as fixed in 7.0.0 with commit d68a1e 10 months ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

A openemr/openemr maintainer

commented 10 months ago

Maintainer

This fix was included in OpenEMR version 7.0.0, which was recently released.

to join this conversation