OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
38Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.6
exploitation probability
—
observed exploitation
nono source reports it
1 public exploit(s)
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
openemr · openemrpublic PoCs found — 1
cve_referencejivasecurity.com/writeups/openemr-unauth-oauth2-client-registrationunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.