GHSA-c82x-f4xr-qv33
epa4all-client: Unauthenticated REST API for Patient Record Writes
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.oviva.telematik:epa4all-rest-service | <= 1.2.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Any network-reachable caller can write arbitrary documents to any patient's electronic
health record accessible by the institution's SMC-B card. In a misconfigured deployment
(e.g., following the production Docker example in the README), this is exploitable from
the local network without credentials.
### Patches
- [#43](https://github.com/oviva-ag/epa4all-client/pull/43)
### Workarounds
Use network policies or proxies to enforce service-to-service authentication via e.g. mTLS.
- run the service in an isolated network namespace e.g. as Kubernetes sidecar
- service-mesh with corresponding policies
### References
- MS-OVIVA-EPA4ALL-8b2af7
### Credits
[Machine Spirits](https://machinespirits.com/) ([[email protected]](mailto:[email protected]))
- Dr. rer. nat. Simon Weber
- Dipl.-Inf. Volker Schönefeld
- Chiara Fliegner
References
External links from the advisory. They lead to third-party sites.