OpenEMR Document Reassignment Access Control Vulnerability

OpenEMR, a free and open source electronic health records and medical practice management application, contains an access control vulnerability in its document write actions.

Prior to version 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation.

• A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access.
• The reassigned document can then be retrieved through the normally protected read path.
• The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked.
• This issue is fixed in version 8.4.0.