Security researchers have found more than 20 bugs in the world’s most popular open source software for managing medical records. Many of the vulnerabilities were classified as severe, leaving the personal information of an estimated 90 million patients exposed to bad actors.
OpenEMR is open source software that’s used by medical offices around the world to store records, handle schedules and bill patients. According to researchers at Project Insecurity, it was also a bit of a security nightmare before a recent audit recommended a range of vital fixes.
The firm reached out to OpenEMR in July to discuss concerns it had about the software’s code. Yesterday a report was released detailing the issues that included: “a portal authentication bypass, multiple instances of SQL injection, multiple instances of remote code execution, unauthenticated information disclosure, unrestricted file upload, CSRFs including a CSRF to RCE proof of concept, and unauthenticated administrative actions.”
Eighteen of the bugs were designated as having a “high” severity, and could’ve been exploited by hackers with low-level access to systems running the software. Patches have been released to users and cloud customers.
OpenEMR’s project administrator Brady Miller told the BBC, “The OpenEMR community takes security seriously and considered this vulnerability report high priority since one of the reported vulnerabilities did not require authentication.”
All’s well that ends well. This isn’t the first time researchers have stepped in to give the group a helping hand with its security, and it surely won’t be the last.
[BBC]