OpenMRS Core vulnerabilities

In OpenMRS, from version 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method evaluates database-stored criteria as Apache Velocity templates without proper sandbox configuration. This allows unrestricted Java reflection through template expressions.

In OpenMRS Core versions 2.7.8 and earlier and 2.8.0 through 2.8.5, the module upload endpoint is vulnerable to a Zip Slip path traversal attack. A crafted archive can write files outside the intended module directory, allowing an authenticated attacker to achieve remote code execution by uploading a JSP file.

OpenMRS Core up to version 2.7.8 and versions 2.8.0-2.8.5 contain a path traversal vulnerability in the `/openmrs/moduleResources/{moduleid}` endpoint. The getFile() function does not validate the path, allowing an unauthenticated attacker to read arbitrary files, including /etc/passwd and configuration files with database credentials. Exploitation is only possible on Apache Tomcat versions prior to 8.5.31.