CVE-2022-31494

Vulnerability

In LibreHealth EHR Base version [2.0.0] (REL-2_0_0) [2], the endpoint gacl/admin/acl_admin.php does not properly sanitize user-supplied input to the action GET parameter, leading to a stored or reflected Cross-Site Scripting (XSS) vulnerability [1]. An authenticated attacker can inject arbitrary JavaScript code that executes in the context of the victim's session when the page is rendered.

Exploitation

An attacker with authenticated access to the EHR application can craft a malicious URL containing JavaScript payload in the action parameter. The attack requires no special privileges beyond a standard user account. The crafted URL can be delivered to other authenticated users via social engineering or by embedding in a page that triggers the XSS. The proof-of-concept demonstrates that the injected script executes without restrictions [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any authenticated user visiting the vulnerable page. This can lead to session hijacking, defacement, theft of sensitive patient data, or actions performed on behalf of the victim. The CIA impact is primarily on confidentiality and integrity of EHR data.

Mitigation

As of the publication date, no official patch has been released for LibreHealth EHR Base 2.0.0. The project maintainers have not issued a fixed version. Users should monitor the official repository [2] for updates. In the absence of a patch, restrict access to administrative interfaces and apply input validation filtering on the action parameter as a workaround.