Christos-Cantina-Security

The Carecoordination module contains an insecure direct object reference (IDOR) issue. This allows authenticated users with `send to hie` permission to access CCDA, CCR, or QRDA documents of any patient. By providing arbitrary document or patient IDs, an attacker can download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

An improper authorization issue exists in the `ScopeRepository::finalizeScopes()` function. This occurs because the `ScopeEntity::containsScope()` function ignores registered permissions, allowing read-only SMART/OAuth clients to obtain write scopes. An attacker with a client registered for `user/<resource>.read` can request `user/<resource>.write` to create, update, and delete patient data or appointments.

An authorization flaw exists in the portal onsite-document APIs. This issue allows an authenticated core user to access documents belonging to other patients. By omitting the `patientId` parameter and providing arbitrary record IDs, an attacker can list, read, and overwrite portal documents, signatures, and template data of other patients.

An authorization bypass exists in the patient portal 'onsitedocuments' API. Authenticated patients can access documents belonging to other patients by overriding query criteria. This is achieved by sending empty `pid Equals` and `denialReason IsNotLike` parameters, which removes patient scoping and locked filters. This exposure can reveal consent bodies, signatures, file paths, and template data.

An improper authorization issue exists in the Rainforest patient portal payments. The system trusts values supplied by the browser instead of deriving them from the portal session. Authenticated portal patients can manipulate the JSON data sent to the 'portal payment.rainforest.php' endpoint. This allows the `payin.authorized` webhook to record forged `ar activity` credits to encounters belonging to other patients, potentially exceeding the actual amount paid.

An improper authorization issue exists in the POST '/fhir/DocumentReference/$docref' endpoint. Users with low-level permissions for demographics and documents can provide a specific patient parameter to generate and download the full-chart CCDA (Continuity of Care Document) from Patient Documents, leading to the exfiltration of clinical data.

An authorization flaw in the classic document controller allows authenticated users with low privileges to recategorize documents belonging to other patients. An attacker can use the `move action process` function to move a document into a patients|demo category and subsequently retrieve it by providing an empty `patient id` variable. This process enables the exfiltration of Protected Health Information (PHI) and the tampering of patient charts.

An incorrect authorization issue exists because the prescription REST API routes validate the `patients.med` Access Control List (ACL) instead of the `patients.rx` ACL and do not request a specific permission bit. This allows users with read-only Medical/History access to bypass intended restrictions. Authenticated staff users can utilize the UI-exposed `APICSRFTOKEN` to enumerate prescription UUIDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the entire tenant.