Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

aisle.com

Post reply on HN
Print view View original

21–30 of 116 posts

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#21

Post by camdenreslink »

simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

I don't think strong development teams are still letting SQL injection vulnerabilities through by manually concatenating strings to build queries with user-provided data. Not in the year 2026.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#22

Post by sheikhnbake »

Taters91 wrote: post #5
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

These kind of checks were available without AI.

Math is doable without a calculator

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#23

Post by hedgehog »

0123456789ABCDE wrote: post #9

something i am missing in this area is education and services. if, during an automated code review, claude finds a vulnerability in a dependency, where should i direct it to share the findings? who would be willing to take the slop-report, and validate it? i've never done vulnerability disclosure, yet, with opus at max effort, i have found some security issues in popular frameworks/libraries i depend on. a proper rep…

It often takes strong understanding of the upstream codebase and roadmap to write a good patch. It's easy enough to write a rough PoC and draft patch but getting all the way through the cycle takes up a bunch of time both from you and the maintainers (who are often already overloaded). My advice would be to draft a bunch privately, take one of the highest impact all the way through a deployed fix, and then plan based on what you learn. Some people's answer is to maintain private forks with automated fixes applied, with a periodic rebase on upstream.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#25

Post by simonw »

camdenreslink wrote: post #21
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

I don't think strong development teams are still letting SQL injection vulnerabilities through by manually concatenating strings to build queries with user-provided data. Not in the year 2026.

Good frameworks can protect against SQL injection and XSS (through default escaping of output variables) but protecting against insecure direct object access is a lot harder.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#26

Post by ranger_danger »

> used by over 100,000 medical providers serving more than 200 million patients across 34 languages

Interesting... I have been working with many different EHR platforms across the country for the last 15 years and I have never heard of OpenEMR before, or any open-source platform for that matter.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#27

Post by capiki »

tmoertel wrote: post #13
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

> Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. Seems like code review against a checklist of the most common vulnerabilities would have prevented these problems. So I guess there are two takeaways here: First, AI scanners are useful for catching security probl…

What about having the checklist and having an AI tool use it to catch things at review time (or even development time)?

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#28

Post by simonw »

tmoertel wrote: post #13
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

> Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. Seems like code review against a checklist of the most common vulnerabilities would have prevented these problems. So I guess there are two takeaways here: First, AI scanners are useful for catching security probl…

Yee, absolutely. A team with a strong code review culture that incorporates security review against common exploits ideally wouldn't end up with holes like this.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#29

Post by tmoertel »

dgb23 wrote: post #18
tmoertel wrote: post #13

Earlier quoted context omitted.

> Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. Seems like code review against a checklist of the most common vulnerabilities would have prevented these problems. So I guess there are two takeaways here: First, AI scanners are useful for catching security probl…

But by not having a checklist you avoid that your blind spots get exposed.

Why would you want to prevent your development team from learning about their blind spots?

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#30

Post by happytoexplain »

sheikhnbake wrote: post #22
Taters91 wrote: post #5

Earlier quoted context omitted.

These kind of checks were available without AI.

Math is doable without a calculator

The headline is "AI uncovers...", implying that the standard static analyzers used by basically everybody didn't catch them.
Post reply on HN