OpenEMR up to 5.0.1.3 File Upload manage_site_files.php unrestricted upload

Summaryinfo

A vulnerability has been found in OpenEMR up to 5.0.1.3 and classified as critical. The impacted element is an unknown function of the file interface/super/manage_site_files.php of the component File Upload. Performing a manipulation results in unrestricted upload. This vulnerability is identified as CVE-2018-15139. The attack can be initiated remotely. Additionally, an exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenEMR up to 5.0.1.3 (Business Process Management Software). It has been classified as critical. This affects an unknown part of the file interface/super/manage_site_files.php of the component File Upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.

The bug was discovered 08/07/2018. The weakness was released 08/13/2018 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2018-15139 since 08/07/2018. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:interface/super/manage_site_files.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.0.1.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (49998). Entries connected to this vulnerability are available at VDB-122815, VDB-122814, VDB-122813 and VDB-122812. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 5.0.1.0
• 5.0.1.1
• 5.0.1.2
• 5.0.1.3

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion