Vulnerability

LifePoint Informatics Patient Portal generated lab report PDFs from a URL and a patient ID

MedDevice Cyber Staff · Apr 5 · 2 min read · Via CISA ICSMA-22-095-01

CISA published advisory ICSMA-22-095-01 on April 5, 2022, covering CVE-2022-1067 in LifePoint Informatics Patient Portal version LPI 3.5.12.P30. Andrew Perrong reported it.

The flaw is an authentication bypass using an alternate path (CWE-288, CVSS v3 6.5). Navigating to a specific URL with a patient ID number made the server generate a PDF of that patient's lab report, with no authentication check and no rate limiting. A sequential or guessable ID turns that into a bulk download of HIPAA-protected records.

LifePoint deployed LPI 3.5.15 in February 2022, before the advisory went public. The portal is hosted, so customers had nothing to install.

Any endpoint that takes a record ID must check that the caller owns the record, and a rate limit is the cheapest alarm you will ever build.

Are you a representative of LifePoint Informatics? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

LifePoint Informatics fixed CVE-2022-1067 in hosted version LPI 3.5.15 in February 2022, so portal users have no patch to apply. Labs that offer the portal should confirm their tenant runs 3.5.15 or later and review access logs for bulk report requests before that date.

Confirm the hosted version. Verify with LifePoint that your portal runs LPI 3.5.15 or later.
Review report access logs. Look for high volumes of lab report PDF requests across many patient IDs before February 2022.
Check object-level authorization. In any patient-facing portal you build or buy, test that each report request is tied to the authenticated patient and rate limited.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface Handles patient data

Contributing

Cloud connectivity Patient or study database

Patient Portal

PID-311 PID-331 Web interface Handles patient data Cloud connectivity

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

25 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2022-1067 in LifePoint Informatics Patient Portal?

CVE-2022-1067 is an authentication bypass (CWE-288, CVSS v3 6.5) in LifePoint Informatics Patient Portal LPI 3.5.12.P30. A specific URL with a patient ID number made the server generate a lab report PDF without authentication or rate limiting. CISA published it as ICSMA-22-095-01 on April 5, 2022.

Do LifePoint Patient Portal customers need to patch CVE-2022-1067?

No. LifePoint Informatics deployed LPI 3.5.15 to its hosted Patient Portal in February 2022, which mitigated CVE-2022-1067, and users need to take no action, according to CISA advisory ICSMA-22-095-01 from April 5, 2022.

← Back to Vulnerabilities