FHIR Validator Vulnerability: Risk of Credential Theft and SSRF

Details

The FHIR Validator HTTP service within HAPI FHIR exposes an unauthenticated `/loadIG` endpoint that accepts external URLs without proper validation. Combined with a `startsWith()` URL prefix matching flaw in the credential provider, an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This vulnerability affects versions of hl7_fhir_core prior to 6.9.4. Exploitation involves Server-Side Request Forgery (SSRF), allowing attackers to exfiltrate authentication credentials for configured FHIR servers. The impact includes potential supply chain attacks on FHIR package registries, exposure of protected health information if the stolen credentials grant access, and compromise of external systems. The patch requires updating `hl7_fhir_core` to version 6.9.4 or later. This update implements proper URL origin comparison instead of prefix matching and adds URL allowlisting validation to the LoadIGHTTPHandler. Mitigation strategies include restricting outbound HTTP(S) requests at the network level, disabling unnecessary credentials in the configuration file, and restricting access to the `/loadIG` endpoint via authentication or segmentation.