Description
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenHealthForAll OpenHealth
Default version status: unaffected
0 to ≤ 0.2.0affected
pkg:github/OpenHealthForAll/open-healthReferences
- https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor ↗
- https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43 ↗
- https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20 ↗
- https://github.com/OpenHealthForAll/open-health ↗
- https://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route ↗