Executive brief
AWS FHIR Works is a healthcare API framework used to deploy compliant FHIR services. A flaw in its authorization library allows authenticated clients to retrieve more medical records than their OAuth permissions allow when performing search queries, potentially exposing sensitive patient data beyond what the client should access.
Technical details
The fhir-works-on-aws-authz-smart library improperly validates OAuth scopes during search-type API requests (CWE-200, CWE-281). An authenticated attacker with limited OAuth credentials can craft search requests to retrieve additional patient information beyond their authorized scope. The vulnerability does not permit access to patients outside the client's existing authorization boundary. Affected versions 3.1.1 and 3.1.2 should be patched to 3.1.3 or higher; versions 3.1.0 and below are unaffected.
Affected products
- AWS fhir-works-on-aws-authz-smart 3.1.1 through 3.1.2
Timeline
- 2022-09-21: disclosed
- 2022-09-21: patched: Version 3.1.3 released with patch