The ePA 3.x Integration component of fbeta-GmbH's ePA3-Service-OpenSource handles authorization and writes medical information to Germany's electronic patient record system. Versions before 1.3.0 fail to increment the request_counter in app/vau/VAUProtokoll.py, causing reuse of AES-GCM nonce and key pairs across server responses. This nonce reuse allows a network attacker who collects repeated ciphertexts to recover the XOR of plaintexts and exploit predictable HTTP headers and JSON fields to extract sensitive data, including patient health records. Additionally, repeated nonces enable recovery of the GHASH authentication key via the Joux forbidden attack, permitting forged AES-GCM messages and injection of malicious responses. The response-counter check also does not maintain last_response_counter, weakening replay protection and message ordering validation. The vulnerability is resolved in version 1.3.0.

Exploitation can lead to disclosure of sensitive patient health records through ciphertext analysis and plaintext recovery. Attackers may also forge AES-GCM authenticated messages and inject malicious responses, compromising data integrity and authenticity. Replay and ordering protections are weakened, increasing risk of message manipulation. The CVSS score of 7.4 reflects high impact on confidentiality and integrity with network attack vector and no privileges required.

This vulnerability is fixed in ePA3-Service-OpenSource version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate the issue. No additional mitigations are indicated by the vendor advisory.