CVE-2024-2134 in Hospital AutoManager
Summary
by MITRE • 03/03/2024
A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file /investigation/delete/ of the component Investigation Report Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255496. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2025
This vulnerability resides within the Bdtask Hospita AutoManager software version 20240223 and earlier, representing a critical cross-site request forgery flaw in the investigation report handler component. The specific affected file path /investigation/delete/ indicates that the vulnerability occurs within the deletion functionality of investigation reports, creating a dangerous attack surface where unauthorized actions can be executed without proper user consent or authentication. The vulnerability's classification as problematic suggests it represents a significant security risk that could enable malicious actors to perform unauthorized operations on the system.
The technical implementation of this CSRF vulnerability stems from the absence of proper anti-CSRF tokens or validation mechanisms within the investigation report deletion handler. When a user navigates to the affected endpoint, the application fails to verify that the request originates from a legitimate user session rather than being forged by an attacker. This fundamental flaw allows remote attackers to craft malicious web pages or emails that, when clicked by an authenticated user, automatically execute the delete operation on investigation reports without the user's knowledge or explicit consent. The vulnerability's remote exploitability means attackers can initiate the attack from any location without requiring physical access to the system or direct network connectivity to the target environment.
The operational impact of this vulnerability extends beyond simple data deletion, potentially compromising the integrity and availability of critical healthcare information within the hospital management system. Attackers could systematically delete investigation reports, undermining the organization's ability to maintain proper medical records and potentially violating healthcare compliance requirements such as HIPAA or GDPR data protection standards. The lack of vendor response to early disclosure attempts compounds the risk, as organizations cannot rely on official patches or updates to address the vulnerability, leaving them exposed to potential exploitation. This scenario creates a particularly dangerous environment where legitimate users remain vulnerable to attacks while the vendor fails to acknowledge or remediate the security issue.
Security practitioners should implement immediate mitigations including the deployment of web application firewalls that can detect and block suspicious CSRF patterns, the implementation of proper anti-CSRF token mechanisms, and the restriction of administrative functions to specific IP addresses or secure network segments. Organizations should also conduct thorough security assessments of the entire AutoManager platform to identify similar vulnerabilities in other components, as this flaw likely indicates broader architectural weaknesses in the application's security design. The vulnerability's public disclosure status means that threat actors have already developed exploit techniques, making immediate remediation essential to prevent potential data breaches or system compromise. This case demonstrates the critical importance of vendor security responsiveness and the need for organizations to maintain independent security monitoring capabilities when vendors fail to address known vulnerabilities in a timely manner.