CVE-2020-11436

Vulnerability

LibreHealth EHR version 2.0.0 is vulnerable to cross-site scripting (XSS) that allows an attacker to execute arbitrary JavaScript in the context of another user's session [1]. The official description confirms the vulnerability exists in v2.0.0 and that it can be used to force actions on behalf of other users, including administrators. The advisory from Bishop Fox lists this as one of five high-risk issues discovered in the application [1], noting that fixes are in progress but no patched release was available at the time of writing [1].

Exploitation

According to the advisory, the XSS vulnerability can be exploited by an unauthenticated malicious actor or a low-privileged application user [1]. While the specific trigger mechanism is not detailed in the public references, the advisory categorizes the XSS issue as one that "would allow attackers to force actions on other user's behalf" [1]. The associated CSRF issue [1] further suggests that an attacker could chain these vulnerabilities, potentially using a phishing page to deliver the attack from an unauthenticated context.

Impact

Successful exploitation of the XSS vulnerability allows the attacker to perform arbitrary actions within the application in the context of the victim user [1]. Because this includes administrators, the attacker could gain elevated privileges and potentially compromise the entire application server and access highly sensitive medical records and personally identifiable information (PII) [1]. The overall impact is rated high-risk by the researcher [1].

Mitigation

As of the advisory publication date, no official patched release of LibreHealth EHR was available [1]. The advisory states that "fixes are in progress and some are available as unmerged pull requests" [1], but no specific version or release date for a fix is provided. Users should monitor the project's official site [2] and the advisory page [3] for updates. No workaround is mentioned in the available references.