OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.
The OpenEMR application in payment processing files (front_payment.php and portal_payment.php) renders the value of the secret gateway_api_key directly in the response sent to the client's browser in plaintext form. A logged-in user (requiring a low privilege level, as confirmed by the CVSS PR:L vector) can read this key, for example from the page source code or network traffic. Since the scope of the vulnerability extends beyond the application instance (S:C in CVSS), the consequences affect external payment gateway systems.
An attacker with access to the exposed API key can take control of the payment gateway account or perform unauthorized financial operations (so-called arbitrary money movement), posing a serious financial risk and violating the confidentiality of payment data.
OpenEMR should be updated to version 8.0.0, in which the vulnerability has been fixed (commit fe6341496dc82d5b4f5a3f35891bb2e2481f3b25). After updating, it is recommended to immediately rotate (exchange) all payment gateway API keys configured in the system, as previously exposed keys should be considered compromised.
OpenEMR versions from 5.0.2 to before 8.0.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NOpen Emr Openemr
APPOpen-Emr5.0.2 – 8.0.0 (excl.)
Related vulnerabilities
RCE w OpenEMR przez eval() injection w komponencie CategoryTree
Command Injection w funkcji backup OpenEMR (wersje przed 8.0.0.2)
OpenEMR: ujawnienie tokenów API MedEx bez uwierzytelnienia (Auth Bypass)
SQL Injection w OpenEMR — narażenie danych PHI przez parametr _sort
OpenEMR: path traversal umożliwia odczyt dowolnych plików przez uwierzytelnionego użytkownika