Critical security flaws in the widely-used OpenEMR health records storage system left millions of patient records vulnerable, researchers have revealed.
A host of flaws in version 5.0.1.3 of the open source system used by organisations across the world - including a portal authentication bypass, instances of SQL injection, as well as remote code execution - left the records of more than 90 million patients vulnerable.
The 23 issues - many described as 'high risk' - outlined in a vulnerability report were discovered by a team of seven cyber security experts from Project Insecurity who manually reviewed OpenEMR's source code without the use of any automated analytical tools.
The researchers brought these vulnerabilities to the developer's attention last month, before the vendor released an update fixing the vulnerabilities less than two weeks later on 20 July. Full disclosure of the vulnerabilities were made yesterday as per an agreement between OpenEMR and Project Insecurity.
"We've seen a lot of medical-related breaches in the media lately and it made us think about the entire transition from regular handling of medical records to them being dealt with electronically and the security implications of that," said Project Insecurity's CEO Matt Telfer, speaking with databreaches.net.
"After some googling we found that OpenEMR was the most widely-deployed open-source electronic medical record application on the internet. And the fact that it's open source meant that we could test it without any negative legal implications."
The research team also issued a number of recommendations the developers could deploy to prevent further exploitation in future, including PHP modifications to prevent SQL injection attacks, and blacklisting malicious extensions to mitigate the risk of unrestricted file uploads.
Project Insecurity's chief financial officer Brian Hyde told IT Pro the team wasn't able to say whether malicious actors had already taken advantage of the frailties, but added a dedicated hacker would have been able to find them "in a rather trivial manner".
He added some of the exploits "could have potentially been there since the very first release of OpenEMR".
OpenEMR is one of the world's most widely-used systems for storing medical records and managing medical practices, and boasts thousands of downloads each month.
The open source system is predominantly used in the US, and on Windows devices, but is also popular in a host of other countries including India, and Honduras. OpenEMR does have a presence in the UK - but it is not as widely-used; only 19th in most downloads by country in the last five years.
Concerns over the security of patient data have never been higher - particularly as health records across the NHS are increasingly being stored digitally. Speaking with IT Pro in June, experts highlighted the risks of migrating patient data to the public cloud, claiming patients would be put at risk if cloud migration is done purely as a cost-saving exercise.
NHS Digital told IT Pro OpenEMR is not used from a national perspective, but local organisations are able to procure their own systems from a variety of suppliers.
It is unlikely OpenEMR is used in the NHS, the spokesperson added, due to its exclusion from the main channels through which Primary and Secondary Care organisations procure their services.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
