The ePA 3.x Integration component of fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0 improperly handles the request_counter in app/vau/VAUProtokoll.py, causing reuse of AES-GCM nonce and key pairs across server responses. This cryptographic misuse allows a network attacker who captures repeated ciphertexts to recover the XOR of plaintext messages, leveraging predictable HTTP headers and JSON fields to extract sensitive patient health records. Furthermore, repeated nonces facilitate recovery of the GHASH authentication key through the Joux forbidden attack, enabling the attacker to forge AES-GCM messages and inject malicious responses. The response-counter check also fails to update last_response_counter, weakening protections against replay and message ordering attacks. The vulnerability is resolved in version 1.3.0.

An attacker capable of intercepting network traffic can exploit nonce reuse in AES-GCM encryption to recover sensitive plaintext data, including patient health records. The vulnerability also allows recovery of the GHASH authentication key, enabling message forgery and injection of malicious responses. Additionally, weakened replay and ordering validation may allow attackers to replay or reorder messages undetected. This compromises confidentiality and integrity of the affected system's communications.

This vulnerability is fixed in ePA3-Service-OpenSource version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate the issue. No other mitigation is indicated by the vendor advisory.