CVE-2023-22974: 
OpenEMR vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2023-22974) was discovered in OpenEMR versions prior to 7.0.0. The vulnerability exists in the setup.php file, allowing remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server (OpenEMR Patches, SonarSource Blog).

The vulnerability stems from the installer not being deleted after installation and the setup being divided into several steps that unauthenticated users can access. An attacker can specify configuration during setup steps by setting properties of the Installer class. When the displayNewThemeDiv method is called, it executes a MySQL query to read the current theme. Since no database connection is established, a new one is created with attacker-controlled properties. Using a malicious MySQL server, an attacker can exploit the LOAD DATA LOCAL INFILE feature to read arbitrary files from the client system (SonarSource Blog).

The vulnerability allows unauthenticated attackers to read sensitive files from the OpenEMR server, including certificates, passwords, tokens, and backups. This access to sensitive data could potentially lead to further system compromise and unauthorized access to patient information (SonarSource Blog).

The vulnerability is exploitable by unauthenticated remote attackers. The exploit requires the attacker to set up a malicious MySQL server and convince the OpenEMR instance to connect to it. The vulnerability is particularly severe because it requires no authentication and can be exploited if the OpenEMR instance has mysqli.allow_local_infile=On configured, which is a common setting (SonarSource Blog).

The vulnerability has been patched in OpenEMR version 7.0.0. Users should upgrade to this version or later to protect against this vulnerability. Additionally, organizations should ensure proper security configurations and access controls are in place (OpenEMR Patches).