Security

bradymiller wrote on Wednesday, February 20, 2013:

Hi,

Cleaned up the Security Vulnerability page a bit:
http://www.open-emr.org/wiki/index.php/Security_Alert_Fixes

Also fixed and committed some of the minor security issues:
http://github.com/openemr/openemr/commit/eff71fbbc49fc26249cd587e59994f265802d140

And recently committed the following security fix for an issue that is going to be published soon:
http://github.com/openemr/openemr/commit/ada2650ee60e3599b77408a1aa61f480f8693681

Planning to bring this all into a 4.1.1 patch soon,
-brady
OpenEMR

bigpawpa wrote on Thursday, March 07, 2013:

Hello,
When click on save in the administration - globals section i get the following error:
Forbidden
You don’t have permission to access /openemr/interface/super/edit_globals.php on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

I contacted my service provider and their response was:

Hello

  The error you are seeing is because mod_security is blocking the access due to the insecure way of access your script is making and it can be exploited for file injection and remote file include and in a wrong hands this vulnerability can be exploited and can be used for hacking your own account and it in turn will affect the server so the solution here is to contact any developers and fix that vulnerability by changing the way your script access the URLs and pass the values and that will make your site more secure and will help it from getting hacked or getting uploaded with malicious contents and this feature which is blocking your access now is for your own security so instead of us disabling it what you need to do is to fix it and thats the permanent solution for it and that will be helpful for you in the long run and adds security to your site. Hope you have understood the situation and expecting your co-operation in this.

Thank you in advance for your help
AJ

sriniemr wrote on Thursday, March 07, 2013:

Aj

Could you check the file permission for  /openemr/interface/super/edit_globals.php??May be that cause this access

Please let me know

Srini
seenu4043@gmail.com

robertrambo wrote on Thursday, March 07, 2013:

do you have a php.ini ?

robertrambo wrote on Thursday, March 07, 2013:

register_globals=on

robertrambo wrote on Thursday, March 07, 2013:

I have had problems like this before the .htacess php.ini mod_security they seem to interact in some strange ways at times!
Hope you get it let me know?

-Rob

robertrambo wrote on Thursday, March 07, 2013:

Just found this
PHP  ->http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/08-miscellaneous.html

PHP peculiarities

When writing ModSecurity rules that are meant to protect PHP applications one needs to have a list of PHP peculiarities in mind. It is often easy to design a rule that works when you are attacking yourself in one way but completely miss an attack variant. Below is a list of things I am aware about:

When the register_globals is set to On request parameters become global variables. (In PHP 4.x it is even possible to override the GLOBALS array).

Cookies are treated as request parameters.

Whitespace at the beginning of parameters is ignored.

The remaining whitespace (in parameter names) is converted to underscores.

The order in which parameters are taken from the request and the environment is EGPCS (environment, get, post, cookies, built-in variables). This means that a POST parameter will overwrite the parameters transported on the request line (in QUERY_STRING).

When the magic_quotes_gpc is set to On PHP will use backslash to escape the following characters: single quote, double quote, backslash, and NULL.

If magic_quotes_sybase is set to On only the single quote will be escaped using another single quote. In this case the magic_quotes_gpc setting becomes irrelevant.

Preventing register_global problems

Nowadays it is widely accepted that using the register_globals feature of PHP leads to security problems, but it wasn’t always like this (if you don’t know what this feature is then you are probably not using it; but, hey, read on the discussion is informative). In fact, the register_globals feature was turned on by default until version 4.2.0. As a result of that, many applications that exist depend on this feature (for more details have a look at http://www.php.net/register_globals ).

If you can choose, it is better to refactor and rewrite the code to not use this feature. But if you cannot afford to do that for some reason or another, you can use ModSecurity to protect an application from a known vulnerability. Problematic bits of code usually look like this:

<?php
// this is the beginning of the page
if ($authorised) {
    // do something protected
}
// the rest of the page here
?>
And the attacker would take advantage of this simply by adding an additional parameter to the URL. For example, http://www.modsecurity.org/examples/test.php?authorised=1

Rejecting all requests that explicitly supply the parameter in question will be sufficient to protect the application from all attackers:

<Location /vulnerable-application/>
    SecFilterSelective ARG_authorised “!^$”
    SecFilterSelective COOKIE_authorised “!^$”
</Location>
The filter above rejects all requests where the variable “authorised” is not empty. You can also see that we’ve added the <Location> container tag to limit filter only to those parts of the web server that really need it.

bigpawpa wrote on Monday, March 11, 2013:

Super folder is 0755
edit_globals is 0644

thanx
aj