CVE-2023-22973
📋 TL;DR
This CVE describes a Local File Inclusion vulnerability in OpenEMR's interface/forms/LBF/new.php file that allows authenticated remote attackers to execute arbitrary code by manipulating the formname parameter. It affects OpenEMR versions before 7.0.0. Healthcare organizations using vulnerable OpenEMR installations are at risk.
💻 Affected Systems
- OpenEMR
📦 What is this software?
Openemr by Open Emr
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to patient data exfiltration, ransomware deployment, or complete healthcare system disruption.
Likely Case
Unauthorized access to sensitive patient health information (PHI), installation of backdoors, or lateral movement within the network.
If Mitigated
Limited impact due to network segmentation, minimal user privileges, and proper monitoring catching exploitation attempts.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. Public proof-of-concept details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.0
Vendor Advisory: https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29
Restart Required: No
Instructions:
1. Backup your OpenEMR installation and database. 2. Download OpenEMR version 7.0.0 or later from the official website. 3. Follow the upgrade instructions at https://www.open-emr.org/wiki/index.php/Upgrading_OpenEMR. 4. Verify the patch is applied by checking the version.
🔧 Temporary Workarounds
Restrict access to vulnerable file
allTemporarily block or restrict access to the vulnerable interface/forms/LBF/new.php file
# For Apache: Add to .htaccess
<Files "new.php">
Deny from all
</Files>
# For Nginx: Add to server block
location ~ /interface/forms/LBF/new\.php$ {
deny all;
}
Implement WAF rules
allAdd web application firewall rules to detect and block LFI exploitation attempts
# Example ModSecurity rule
SecRule ARGS:formname "@rx \.\./" "id:1001,phase:2,deny,msg:'LFI attempt detected'"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpenEMR from critical systems
- Enforce least privilege access controls and monitor all authenticated user activity
🔍 How to Verify
Check if Vulnerable:
Check if OpenEMR version is below 7.0.0 and examine the interface/forms/LBF/new.php file for the vulnerable code pattern.Check Version:
Check the OpenEMR version in the admin interface or examine the version.php file: cat /path/to/openemr/version.php | grep '\$v_\|openemr_version'Verify Fix Applied:
Verify OpenEMR version is 7.0.0 or higher and that the patch has been applied to the interface/forms/LBF/new.php file.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in interface/forms/LBF/new.php
- Multiple failed authentication attempts followed by successful login and file inclusion attempts
- Log entries showing directory traversal patterns (../) in formname parameter
Network Indicators:
- Unusual outbound connections from OpenEMR server
- Traffic patterns indicating data exfiltration
SIEM Query:
source="openemr_logs" AND ("new.php" AND ("../" OR "..\\" OR "%2e%2e%2f"))🔗 References
- https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29
- https://www.sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system/
- https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29
- https://www.sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system/
