CVE-2023-24057: HL7 FHIR Core Path Traversal Vulnerability

CVE-2023-24057 Overview

CVE-2023-24057 is a directory traversal vulnerability affecting HL7 (Health Level 7) FHIR Core Libraries before version 5.6.92. This vulnerability allows attackers to extract files into arbitrary directories via directory traversal techniques using a crafted ZIP or TGZ archive. The malicious archives can be delivered through multiple vectors including prepackaged terminology caches, NPM packages, or comparison archives.

Critical Impact

Attackers can write arbitrary files to any location on the filesystem, potentially leading to remote code execution, data corruption, or complete system compromise in healthcare environments processing FHIR-based data.

Affected Products

• hapifhir hl7_fhir_core (versions before 5.6.92)
• hl7 fhir_ig_publisher (affected versions)
• Systems utilizing FHIR terminology caches, NPM packages, or comparison archives

Discovery Timeline

• 2023-01-26 - CVE CVE-2023-24057 published to NVD
• 2025-04-01 - Last updated in NVD database

Technical Details for CVE-2023-24057

Vulnerability Analysis

This vulnerability stems from improper validation of file paths during archive extraction operations in the HL7 FHIR Core Libraries. When the library processes ZIP or TGZ archives—commonly used for terminology caches, NPM packages, or comparison archives—it fails to adequately sanitize file paths contained within the archive. This allows an attacker to craft an archive containing files with relative path sequences (such as ../) that, when extracted, write files outside the intended destination directory.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. Healthcare organizations using FHIR-based interoperability solutions are particularly at risk, as these libraries are fundamental to processing healthcare data exchange standards.

Root Cause

The root cause of CVE-2023-24057 is the absence of proper path canonicalization and validation during the archive extraction process. When extracting files from ZIP or TGZ archives, the library directly uses the filename paths specified within the archive without verifying that the resulting extraction path remains within the designated target directory. This allows specially crafted path components like ../ to traverse up the directory tree and write files to arbitrary locations on the filesystem.

Attack Vector

This vulnerability can be exploited remotely over a network. An attacker can deliver a malicious archive to a vulnerable system through several vectors:

1. Terminology Cache Poisoning: Malicious terminology cache archives distributed through compromised or malicious sources
2. NPM Package Supply Chain: Crafted NPM packages containing malicious archive payloads
3. Comparison Archive Manipulation: Tampered comparison archives processed by the FHIR IG Publisher

When the vulnerable library extracts the malicious archive, files are written outside the intended directory, potentially overwriting critical system files, configuration files, or placing executable payloads in sensitive locations.

The attack does not require authentication or user interaction, though the complexity is elevated as it requires the attacker to either control a package source or intercept legitimate archive deliveries.

Detection Methods for CVE-2023-24057

Indicators of Compromise

• Unexpected files appearing in directories outside FHIR application working directories
• Log entries showing archive extraction operations with suspicious path patterns containing ../ sequences
• Modified system configuration files or unexpected executable files in system directories
• Unusual file creation timestamps in sensitive system locations correlating with FHIR data processing events

Detection Strategies

• Monitor file system activity for write operations outside expected FHIR library directories during archive extraction
• Implement application logging to capture all archive extraction operations and review for path traversal patterns
• Use file integrity monitoring (FIM) solutions to detect unauthorized file modifications in critical system directories
• Audit NPM package dependencies and terminology cache sources for unexpected or unsigned packages

Monitoring Recommendations

• Enable detailed logging for all FHIR library operations, particularly archive handling functions
• Configure alerts for file creation events in system directories that correlate with FHIR application activity
• Monitor network traffic for downloads of terminology caches or NPM packages from untrusted sources
• Implement supply chain security monitoring for FHIR-related dependencies

How to Mitigate CVE-2023-24057

Immediate Actions Required

• Upgrade HL7 FHIR Core Libraries to version 5.6.92 or later immediately
• Audit all systems running vulnerable versions and check for signs of compromise
• Review and validate the integrity of any previously processed terminology caches, NPM packages, and comparison archives
• Implement network segmentation to limit the potential impact of file write operations from FHIR-processing systems

Patch Information

The vulnerability has been addressed in HL7 FHIR Core Libraries version 5.6.92 and later. Organizations should update to the patched version as soon as possible. Additional details are available in the GitHub Security Advisory for FHIR IG Publisher.

Workarounds

• Restrict archive processing to trusted and verified sources only until patching is complete
• Implement strict input validation at the application layer to reject archives containing path traversal sequences
• Run FHIR processing applications with minimal filesystem permissions to limit the impact of arbitrary file writes
• Use containerization or sandboxing to isolate FHIR library operations from critical system resources

# Configuration example - Verify FHIR Core Library version
# Check Maven dependency version
mvn dependency:tree | grep -i fhir

# Update to patched version in pom.xml
# Ensure version is 5.6.92 or higher
# <dependency>
#   <groupId>ca.uhn.hapi.fhir</groupId>
#   <artifactId>org.hl7.fhir.core</artifactId>
#   <version>5.6.92</version>
# </dependency>