CVE-2020-19364
📋 TL;DR
CVE-2020-19364 is an unrestricted file upload vulnerability in OpenEMR that allows authenticated attackers to upload and execute malicious PHP scripts via the /controller.php endpoint. This enables remote code execution on affected systems. Any organization running vulnerable OpenEMR versions is at risk.
💻 Affected Systems
- OpenEMR
📦 What is this software?
Openemr by Open Emr
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, lateral movement within the network, and persistent backdoor installation.
Likely Case
Attacker gains shell access to the web server, exfiltrates sensitive patient data, and installs web shells for persistent access.
If Mitigated
Attack is detected during file upload attempt, blocked by WAF/file validation, or fails due to proper file permission restrictions.
🎯 Exploit Status
Exploitation requires valid user credentials but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.2 and later
Vendor Advisory: https://github.com/openemr/openemr/security/advisories
Restart Required: No
Instructions:
1. Backup your OpenEMR installation and database. 2. Download OpenEMR 5.0.2 or later from the official repository. 3. Replace vulnerable files with patched versions. 4. Verify file permissions and ownership. 5. Test application functionality.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file type validation and whitelist allowed extensions
Modify /controller.php to validate file extensions before processing
Web Application Firewall Rules
allBlock PHP file uploads to /controller.php endpoint
Add WAF rule: deny requests to /controller.php with file uploads containing .php extensions
🧯 If You Can't Patch
- Implement strict file upload validation in application code
- Restrict web server permissions to prevent PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if OpenEMR version is 5.0.1 or earlier and review /controller.php for proper file upload validationCheck Version:
Check OpenEMR version in interface or review version.php fileVerify Fix Applied:
Verify OpenEMR version is 5.0.2 or later and test file upload functionality with PHP files📡 Detection & Monitoring
Log Indicators:
- File upload attempts to /controller.php with .php extensions
- Unusual file creation in upload directories
- POST requests to /controller.php with file parameters
Network Indicators:
- HTTP POST requests to /controller.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="/controller.php" AND method="POST" AND file_upload="true")