CVE-2023-40275
📋 TL;DR
This vulnerability in OpenClinic GA allows unauthenticated attackers to retrieve patient lists via direct API queries to searchByAjax/patientslistShow.jsp. It affects OpenClinic GA installations, exposing sensitive patient information without requiring authentication.
💻 Affected Systems
- OpenClinic GA
📦 What is this software?
Openclinic Ga by Openclinic Ga Project
⚠️ Risk & Real-World Impact
Worst Case
Mass exfiltration of all patient records including names, contact information, and medical data, leading to privacy violations, regulatory fines, and reputational damage.
Likely Case
Unauthorized access to patient lists containing names and basic demographic information, violating patient privacy and healthcare regulations.
If Mitigated
Limited exposure if proper authentication and access controls are implemented, restricting access to authorized personnel only.
🎯 Exploit Status
Simple HTTP GET requests to vulnerable endpoint with query parameters can retrieve patient data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://sourceforge.net/projects/open-clinic/
Restart Required: No
Instructions:
Check OpenClinic project page for updates. No official patch available as of analysis date.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to OpenClinic application to trusted networks only using firewall rules.
iptables -A INPUT -p tcp --dport [OpenClinic-port] -s [trusted-network] -j ACCEPT
iptables -A INPUT -p tcp --dport [OpenClinic-port] -j DROP
Authentication Enforcement
allImplement authentication middleware or web server authentication for all /_common/search/ paths.
# Configure web server (Apache/Nginx) to require authentication for vulnerable paths
🧯 If You Can't Patch
- Implement network segmentation to isolate OpenClinic from untrusted networks
- Deploy web application firewall (WAF) with rules to block unauthenticated access to search endpoints
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[target]/_common/search/searchByAjax/patientslistShow.jsp?findFirstname=test and check if patient data is returned without authentication.Check Version:
Check OpenClinic version in application interface or configuration files.Verify Fix Applied:
After implementing controls, verify same request returns authentication error or no patient data.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /_common/search/searchByAjax/patientslistShow.jsp without authentication
- Unusual volume of patient data queries from single IP
Network Indicators:
- HTTP traffic to searchByAjax endpoints without preceding authentication requests
- Pattern of parameterized queries to patientslistShow.jsp
SIEM Query:
source="web_logs" AND url="/_common/search/searchByAjax/patientslistShow.jsp" AND NOT user_agent="*bot*" | stats count by src_ip🔗 References
- https://github.com/BugBountyHunterCVE/CVE-2023-40275/blob/main/CVE-2023-40275_Unauthenticated-Patient-List-Retrieval_OpenClinic-GA_5.247.01_Report.md
- https://sourceforge.net/projects/open-clinic/
- https://github.com/BugBountyHunterCVE/CVE-2023-40275/blob/main/CVE-2023-40275_Unauthenticated-Patient-List-Retrieval_OpenClinic-GA_5.247.01_Report.md
- https://sourceforge.net/projects/open-clinic/
