Pathling
Monthly
The `$import-pnp` operation in Pathling Server allows low-privileged callers to supply an arbitrary `exportUrl`, causing the server to forward its configured PNP credentials to an attacker-controlled FHIR endpoint and stage the returned files as trusted local sources - effectively bypassing the `allowableSources` allowlist that guards the standard `$import` operation. All Pathling Server deployments prior to version 2.0.0 with PNP credentials configured are affected, with high confidentiality and integrity impact (credential theft and unauthorized data import). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack requires only low-privilege API access and is low-complexity.
Pathling Server before version 2.0.0 permits authenticated callers holding only coarse operation-level authorities (e.g., `pathling:search`) to act on arbitrary FHIR resource families - including resource types they are not explicitly authorized to read or write - because typed search, update, and batch handlers enforce the operation-level authority check but skip the documented per-resource authority check (e.g., `pathling:read:Patient`). The flaw breaks the two-factor authorization model the product documents, exposing potentially all FHIR resource families to any valid operation-authority holder. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the vulnerability is fixed in Pathling Server 2.0.0.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., `pathling:search`) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., `pathling:read:Patient`), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with `@OperationAccess(...)` and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.
The `$import-pnp` operation in Pathling Server allows low-privileged callers to supply an arbitrary `exportUrl`, causing the server to forward its configured PNP credentials to an attacker-controlled FHIR endpoint and stage the returned files as trusted local sources - effectively bypassing the `allowableSources` allowlist that guards the standard `$import` operation. All Pathling Server deployments prior to version 2.0.0 with PNP credentials configured are affected, with high confidentiality and integrity impact (credential theft and unauthorized data import). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack requires only low-privilege API access and is low-complexity.
Pathling Server before version 2.0.0 permits authenticated callers holding only coarse operation-level authorities (e.g., `pathling:search`) to act on arbitrary FHIR resource families - including resource types they are not explicitly authorized to read or write - because typed search, update, and batch handlers enforce the operation-level authority check but skip the documented per-resource authority check (e.g., `pathling:read:Patient`). The flaw breaks the two-factor authorization model the product documents, exposing potentially all FHIR resource families to any valid operation-authority holder. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the vulnerability is fixed in Pathling Server 2.0.0.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., `pathling:search`) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., `pathling:read:Patient`), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with `@OperationAccess(...)` and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.