Medplum
Monthly
Unauthenticated exposure of OAuth client_secret credentials via the /oauth2/register endpoint affects Medplum versions 4.1.10 through 5.1.6, a healthcare developer platform widely used to build FHIR-compliant apps. When a caller submits a redirect_uri that matches a pre-configured entry in the server's defaultOAuthClients configuration block, the registration endpoint reflects the stored client_secret back in the response - effectively handing an attacker the credential needed to impersonate that OAuth client. The vendor patched this in version 5.1.7 (PR #8837); no public exploit has been identified at time of analysis.
Server-side request forgery in Medplum versions prior to 5.1.14 lets authenticated users abuse the FHIR Subscription worker to make the server issue HTTP POST requests to arbitrary internal endpoints. Because the worker delivers full FHIR resource payloads to attacker-chosen URLs, attackers can target cloud instance metadata services (e.g., AWS IMDS), internal databases, and orchestrator APIs to steal IAM credentials and exfiltrate patient health records. No public exploit identified at time of analysis, but a vendor patch and a VulnCheck advisory are available.
Unauthenticated exposure of OAuth client_secret credentials via the /oauth2/register endpoint affects Medplum versions 4.1.10 through 5.1.6, a healthcare developer platform widely used to build FHIR-compliant apps. When a caller submits a redirect_uri that matches a pre-configured entry in the server's defaultOAuthClients configuration block, the registration endpoint reflects the stored client_secret back in the response - effectively handing an attacker the credential needed to impersonate that OAuth client. The vendor patched this in version 5.1.7 (PR #8837); no public exploit has been identified at time of analysis.
Server-side request forgery in Medplum versions prior to 5.1.14 lets authenticated users abuse the FHIR Subscription worker to make the server issue HTTP POST requests to arbitrary internal endpoints. Because the worker delivers full FHIR resource payloads to attacker-chosen URLs, attackers can target cloud instance metadata services (e.g., AWS IMDS), internal databases, and orchestrator APIs to steal IAM credentials and exfiltrate patient health records. No public exploit identified at time of analysis, but a vendor patch and a VulnCheck advisory are available.