Vulnerability

OpenClinic GA advisory lists authentication bypass, file upload and SQL abuse flaws

MedDevice Cyber Staff · Jul 2 · 4 min read · Via CISA ICSMA-20-184-01

CISA published advisory ICSMA-20-184-01 on July 2, 2020, for OpenClinic GA versions 5.09.02 and 5.89.05b. Brian D. Hysell reported the vulnerabilities, and the CVSS v3 scores in the record run from 5.4 to 9.8.

The lead flaw is CVE-2020-14485 (CWE-288, CVSS 9.4). An attacker can bypass client-side access controls or send a crafted request to open a session with limited functionality, then run admin functions such as SQL queries. CVE-2020-14484 (CVSS 7.3) bypasses account lockout so passwords can be brute forced, and CVE-2020-14494 (CVSS 7.3) leaves an authentication mechanism without enough complexity to stop brute force.

Authorization is broken too. CVE-2020-14491 (CWE-862, CVSS 8.3) lets a low-privilege user run SQL queries without a permission check. A low-privilege user can also use SQL syntax to write arbitrary files to the server and execute commands (CVSS 8.8). CVE-2020-14490 (CWE-434, CVSS 8.8) accepts unverified uploads that can then be executed, and CVE-2020-14486 (CWE-22, CVSS 6.3) includes arbitrary local files from a parameter.

The rest of the list covers cross-site scripting, end-of-life third-party components with known vulnerabilities, passwords stored with inadequate hashing, and CVE-2020-14492, where ignoring the redirect after a permission failure lets commands run anyway.

CISA says the combined effect could let an attacker bypass authentication, read or change restricted database information and execute malicious code. OpenClinic GA recommends upgrading to Version 5.170.5 or later.

When the access check lives in the browser, the server has no access check. Every function behind the login needs its own server-side authorization.

Are you a representative of OpenClinic GA? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade OpenClinic GA to Version 5.170.5 or later; versions 5.09.02 and 5.89.05b carry the full list of flaws. After upgrading, reset user passwords, since the old builds stored them with weak hashing, and check the server for unexpected uploaded or written files.

Upgrade to 5.170.5. Move OpenClinic GA to Version 5.170.5 or later.
Reset passwords. Force a password change for all users because the affected versions hashed passwords weakly.
Hunt for dropped files. Review the server for files written through SQL or uploads that should not be there.
Enforce authorization server side. Check permissions on every server request, independent of the client and of redirects.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts Role-based access

Contributing

Patient or study database File import Web interface Off-the-shelf software

OpenClinic GA

PID-3321 Patient or study database Role-based access File import User accounts Off-the-shelf software

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID NOW COVID-19 2.0	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Embryo Predict	Alife Health	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
Image Suite	Carestream Health	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Exposed to the same EMB3D threatTID-319	No feedback feed from manufacturer

27 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-14485 in OpenClinic GA?

CVE-2020-14485 is an authentication bypass (CWE-288, CVSS v3 9.4) in OpenClinic GA 5.09.02 and 5.89.05b. An attacker can bypass client-side access controls or use a crafted request to start a session and run admin functions such as SQL queries, per CISA advisory ICSMA-20-184-01 from July 2, 2020.

Which OpenClinic GA version fixes the vulnerabilities in ICSMA-20-184-01?

OpenClinic GA recommends upgrading to Version 5.170.5 or later, which resolves the authentication bypass, file upload, path traversal and other flaws CISA listed for versions 5.09.02 and 5.89.05b in advisory ICSMA-20-184-01.

Can low-privilege users execute code on an OpenClinic GA server?

Yes, on unpatched versions. CISA advisory ICSMA-20-184-01 says a low-privilege OpenClinic GA user can write arbitrary files to the server through SQL syntax and execute commands, and can upload and execute arbitrary files through CVE-2020-14490. Version 5.170.5 fixes both.

← Back to Vulnerabilities