CVE-2021-32101: 
OpenEMR vulnerability analysis and mitigation

CVE-2021-32101 affects the Patient Portal of OpenEMR 5.0.2.1, specifically related to incorrect access control in portal/patient/machineconfig.php. The vulnerability was discovered by researchers at SonarSource and disclosed in October 2020. This insecure API permissions vulnerability allows unauthenticated attackers to bypass authentication and access the system (Sonar Blog, Daily Swig).

The vulnerability exists in the Patient Portal's API interface which uses the Phreeze framework as a dispatcher. The issue stems from improper session handling in portal/patient/machineconfig.php where an attacker can bypass authentication by making an initial HTTP request to register.php to set $_SESSION['register'] to true. Since the session variable is not destroyed at the end of the file, attackers can then access the dispatcher with $ignoreAuth set to true, effectively bypassing authentication controls (Sonar Blog).

Once authentication is bypassed, attackers can access all features of the API as a registered Patient Portal user. This allows unauthorized access to patient data, ability to change email addresses and passwords of patients, and modify information of any backend user including administrators. The vulnerability affects healthcare providers worldwide who use OpenEMR for managing sensitive patient data, including medical records, appointments, and billing information (Sonar Blog, Daily Swig).

The vulnerability was patched in OpenEMR version 5.0.2.2 released in August 2020. Healthcare providers are strongly urged to update their OpenEMR installations to the patched version to protect against this vulnerability (OpenEMR Community, Sonar Blog).

The OpenEMR team responded quickly to the vulnerability report, rating the fixes as critical and releasing security patches immediately to protect users. Robert Down, chief operations officer at the OpenEMR Foundation, acknowledged the findings and emphasized their commitment to addressing critical security vulnerabilities (Daily Swig).