CVE-2020-11439

Vulnerability

LibreHealth EMR version 2.0.0 is affected by a local file inclusion (LFI) vulnerability that allows an attacker to include and execute arbitrary PHP files within the application. The issue resides in the application's handling of file inclusion parameters, enabling path traversal to include files from the server's filesystem. This vulnerability was identified by Bishop Fox and is detailed in their advisory [1]. The affected version is LibreHealth EHR 2.0.0, released September 2017 [2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to the LibreHealth EMR application. The attacker does not require any prior authentication or user interaction. By manipulating file inclusion parameters, the attacker can include arbitrary PHP files from the server, potentially leading to remote code execution. The advisory notes that the LFI can be leveraged to compromise the underlying application server [1].

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to full compromise of the application server. This grants access to sensitive data, including medical records and personally identifiable information (PII) stored within the application. The impact is classified as high risk, as it could result in complete loss of confidentiality, integrity, and availability of the system [1].

Mitigation

As of the publication date of the advisory, no official patched release of LibreHealth EMR v2.0.0 is available. The vendor has fixes in progress, but they have not been merged into a stable release [1]. Users are advised to monitor the LibreHealth project for updates and apply patches as soon as they become available. No workarounds are documented in the available references.