CyberRota Analysis
AI-GeneratedThe `$import-pnp` operation in Pathling Server versions prior to 2.0.0 is vulnerable as it allows users to specify an `exportUrl` for remote FHIR Bulk Export without proper validation, enabling potential unauthorized access to sensitive health data. This flaw can lead to the downloading of untrusted files, effectively bypassing security measures designed to protect data integrity. Organizations utilizing Pathling for health data analytics, especially those handling sensitive patient information, should prioritize upgrading to version 2.0.0 or implementing the recommended workarounds to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.