Vulnerability in OpenHealthForAll OpenHealth

[ Description ]Official description

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/OpenHealthForAll/open-health
• github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/ro…
• github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts
• hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor
• www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-he…