CVE-2022-23612
📋 TL;DR
CVE-2022-23612 is a path traversal vulnerability in OpenMRS that allows attackers to exfiltrate arbitrary files from the server. The vulnerability affects OpenMRS versions before 2.1.5, 2.2.1, 2.3.5, 2.4.5, and 2.5.3 due to insufficient input sanitization in image and script request handlers. Any OpenMRS implementation running affected versions is vulnerable to file disclosure.
💻 Affected Systems
- OpenMRS Core
📦 What is this software?
Openmrs by Openmrs
Openmrs by Openmrs
Openmrs by Openmrs
Openmrs by Openmrs
Openmrs by Openmrs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through exfiltration of sensitive files like configuration files, database credentials, SSH keys, and patient medical records.
Likely Case
Exfiltration of configuration files containing database credentials, API keys, and sensitive system information leading to further attacks.
If Mitigated
Limited file access restricted by Tomcat's URL normalization (Tomcat 7.0.28+) or proper file system permissions.
🎯 Exploit Status
Exploitation requires only HTTP GET requests to vulnerable endpoints with path traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5, 2.2.1, 2.3.5, 2.4.5, or 2.5.3 depending on minor version
Vendor Advisory: https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65
Restart Required: Yes
Instructions:
1. Identify your OpenMRS minor version. 2. Update to the corresponding patch version: 2.1.x → 2.1.5, 2.2.x → 2.2.1, 2.3.x → 2.3.5, 2.4.x → 2.4.5, 2.5.x → 2.5.3. 3. Restart the OpenMRS application server.
🔧 Temporary Workarounds
Tomcat Upgrade
linuxUpgrade Tomcat to version 7.0.28 or later to leverage built-in URL normalization that mitigates the vulnerability.
apt-get update && apt-get install tomcat7
Web Application Firewall
allDeploy WAF rules to block path traversal patterns in requests to /images and /initfilter/scripts endpoints.
🧯 If You Can't Patch
- Implement strict file system permissions to limit OpenMRS process access to only necessary directories.
- Deploy network segmentation to restrict access to OpenMRS instances from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check if OpenMRS version is below the patched versions: 2.1.5, 2.2.1, 2.3.5, 2.4.5, or 2.5.3.Check Version:
Check OpenMRS web interface or application.properties file for version information.Verify Fix Applied:
Verify OpenMRS version matches patched version and test with path traversal payloads to /images and /initfilter/scripts endpoints.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests containing '../' sequences to /images or /initfilter/scripts endpoints
- Unusual file access patterns from OpenMRS process
Network Indicators:
- HTTP requests with path traversal payloads (../, ..\, encoded variants)
- Unusual outbound data transfers following suspicious requests
SIEM Query:
source="openmrs" AND (url_path="/images" OR url_path="/initfilter/scripts") AND (request_uri="*../*" OR request_uri="*..\\*")🔗 References
- https://github.com/openmrs/openmrs-core/blob/ee3373a7a775bfdfa263e2e912c72e64342fb4f0/web/src/main/java/org/openmrs/web/filter/StartupFilter.java#L123
- https://github.com/openmrs/openmrs-core/commit/db8454bf19a092a78d53ee4dba2af628b730a6e7#diff-7c64d9f61d4d4e2ddba92920d7cf63ec96091b308d43904956b3846bc0c26d80R128
- https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65
- https://lgtm.com/projects/g/openmrs/openmrs-core/snapshot/fb1335c925ca4c94be5a546707b90d2c1efa4dcc/files/web/src/main/java/org/openmrs/web/filter/StartupFilter.java#L123
- https://github.com/openmrs/openmrs-core/blob/ee3373a7a775bfdfa263e2e912c72e64342fb4f0/web/src/main/java/org/openmrs/web/filter/StartupFilter.java#L123
- https://github.com/openmrs/openmrs-core/commit/db8454bf19a092a78d53ee4dba2af628b730a6e7#diff-7c64d9f61d4d4e2ddba92920d7cf63ec96091b308d43904956b3846bc0c26d80R128
- https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65
- https://lgtm.com/projects/g/openmrs/openmrs-core/snapshot/fb1335c925ca4c94be5a546707b90d2c1efa4dcc/files/web/src/main/java/org/openmrs/web/filter/StartupFilter.java#L123
