CVE-2020-11438

Vulnerability

LibreHealth EHR v2.0.0 is affected by a systemic cross-site request forgery (CSRF) vulnerability. The application lacks CSRF tokens on multiple endpoints, enabling an attacker to craft requests that execute actions on behalf of an authenticated user. This issue was identified by Bishop Fox and is one of five high-risk vulnerabilities in the release [1]. The affected version is the latest stable release as of September 2017 [2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by tricking an authenticated user into visiting a malicious page or clicking a crafted link. The attacker does not require any prior authentication or special network position. The victim must be logged into the LibreHealth EHR application while the crafted request is triggered. The attacker can then force the victim's browser to submit arbitrary requests, such as modifying patient records, creating new users, or chaining with other vulnerabilities like local file inclusion or SQL injection [1].

Impact

Successful exploitation allows the attacker to perform any action that the victim user is authorized to do, including accessing, modifying, or deleting sensitive medical records and personally identifiable information (PII). Because the application stores highly sensitive health data, this CSRF vulnerability can lead to full compromise of patient confidentiality and data integrity. The attacker can also leverage the victim's session to execute other high-risk attacks, such as local file inclusion or SQL injection, potentially compromising the underlying server [1].

Mitigation

As of the advisory publication date (July 2020), no official patched release of LibreHealth EHR was available. Fixes were in progress but had not been merged into the main codebase [1]. Users should monitor the LibreHealth project website [2] for updates and apply patches as soon as they are released. No workarounds were documented in the available references.