Server-Side Request Forgery in OpenEMR

Executive Summary

OpenEMR before version 8.4.0 has a server-side request forgery (SSRF) vulnerability. Attackers can register an OAuth2 client with a malicious jwks_uri that points to an internal or external target. By using an unsigned client_assertion at the token introspection endpoint, they can force the server to send HTTP requests to probe internal services or access cloud metadata endpoints without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected outbound HTTP/HTTPS requests originating from the OpenEMR server. Check logs for OAuth2 client registration attempts with unusual jwks_uri values pointing to internal or external targets. Use tools like tcpdump or Wireshark to capture outbound connections from the OpenEMR server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to probe internal network services, access cloud metadata, and potentially map internal infrastructure. While responses are not returned to the attacker, the ability to send requests to arbitrary destinations could lead to data exfiltration, service disruption, or further exploitation of internal systems if combined with other flaws.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could violate compliance requirements by exposing internal systems or sensitive data to unauthorized network requests. GDPR may be impacted if personal data is exposed, and HIPAA could be violated if protected health information is accessible through internal service probing. Organizations must ensure systems are patched to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.4.0 or later. Disable dynamic client registration if not required. Restrict outbound network access from the OpenEMR server using firewall rules. Review and validate all registered OAuth2 clients, removing any with suspicious jwks_uri values.

Useful 0 Not Useful 0