Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

aisle.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#71

Post by capitalhilbilly »

tmoertel wrote: post #36
capiki wrote: post #27

Earlier quoted context omitted.

What about having the checklist and having an AI tool use it to catch things at review time (or even development time)?

Having AI tools do the review against the checklist would probably prevent the problems. However, it would probably be substantially inferior as a teaching tool for your team. The exercise of having reviewers hunt the checklisted vulnerabilities for themselves is what develops the mental muscles needed to understand the vulnerabilities in depth and avoid them when designing and writing future code. But, yes, I'd augm…

For vulnerabilities of this nature is there really a point in training if an AI will catch them from now on? Seems like a variant of the allowing calculators problem and maybe the problem codeless platforms would have had. If these style of bugs don't change design in any meaningful way then the user can just write pseudo variables and the AI can normalize to safe code and their ability to work without the AI and IDE is probably less relevant than freeing their cognitive load for more complex constraint problems.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#72

Post by esafak »

0123456789ABCDE wrote: post #65
esafak wrote: post #61

Earlier quoted context omitted.

Share it in the repo's issues, discussions, or chat?

that would be full disclosure, i don't particularly dislike the idea, but it's slop, the devs are already overwhelmed, i don't fully understand the legal implications i would be exposed to.

You can omit the details and share them on request.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#73

Post by Falell »

tmoertel wrote: post #13
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

> Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. Seems like code review against a checklist of the most common vulnerabilities would have prevented these problems. So I guess there are two takeaways here: First, AI scanners are useful for catching security probl…

I think it shows exactly the opposite of the second. Even with the availability of checklists, and instructions to use them, people won't and don't actually use them consistently.

'With enough eyes, all bugs are shallow' and AI is an automatable eye that looks at things we can tell nobody has seriously looked at before. It's not a panacea, there will be lots of false positives, but there's value there that we clearly aren't getting by 'just telling humans to use the tools available'.

See also: modern practices and sanitizers and tools and test frameworks to avoid writing memory errors in C, and the reality that we keep writing memory errors in C.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#74

Post by david_shaw »

We'll see more of this, but this particular review is driven by marketing narrative. I'll explain what I mean:

Back in 2010, as a security engineer, I also looked at OpenEMR. It was an absolute disaster, and was (and is) somewhat well-known as such. I found and published vulnerabilities very similar to these sixteen years ago. This is not exactly the Fort Knox of software.

It makes sense for AISLE to demonstrate that they're able to find vulnerabilities here, but I'd love to see a side-by-side comparison of modern SAST and DAST reviews. I bet we'd find similar vulnerabilities.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#77

Post by tmoertel »

ihaveajob wrote: post #64
simonw wrote: post #28

Earlier quoted context omitted.

Yee, absolutely. A team with a strong code review culture that incorporates security review against common exploits ideally wouldn't end up with holes like this.

I guess the value of the tool is that it gives you that same benefit for the cost of a few tokens.

> I guess the value of the tool is that it gives you that same benefit for the cost of a few tokens.

But it doesn't give you the same benefit. It gives you the partial benefit of catching these problems before they go to production, but it doesn't give you the remaining benefit of teaching your team about where their mental models are broken. A team that decides to delegate this responsibility entirely to AI is going to have a hard time learning about these serious defects in their mental models. Fixing those defects will pay dividends throughout the code base, not just in the places where AI would detect security failing.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#78

Post by simonw »

nudpiedo wrote: post #53
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

There are Static code analyzers which already would have detected that. And these were also automatic. Looks very likely that the team didn’t give a damn about top basic security and good practices. Like a house made of paper wouldn’t be an example of the insecurity of the construction industry.

Which static code analyzers do you recommend?

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#79

Post by floatrock »

hereme888 wrote: post #38

OpenEMR? Used by some missionary doctor in remote Afghanistan?

Right. You're not a real medical group unless you go through an 18-month RFP procurement cycle including being wined and dined by the Epic rep who already knows they're gonna get your $50MM wallet because they're golf buddies with your CEO and already embedded with all your labs. God forbid anyone practicing Real Medicine tries to go the OSS route, medicine is too complicated for something like that.

Re: AISLE Discovers 38 CVEs in OpenEMR Healthcare Software

#80

Post by simonw »

gostsamo wrote: post #33
simonw wrote: post #2

"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit! Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. This is actually a pretty good example of the value o…

> This is actually a pretty good example of the value of AI security scanners Are you fuckin' serious? This would be caught with any self-respecting scanner even 5 years ago and with most educated juniors even earlier. I use AI every day, but I'm not deep enough in the dilulu to believe that everything above two brain cells should be a transformer.

Which scanners catch insecure direct object access?
Post reply on HN