CVE-2025-31117
Published: 31 March 2025
Summary
CVE-2025-31117 is a high-severity SSRF (CWE-918) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the SSRF vulnerability by applying the vendor-released patch in OpenEMR version 7.0.3.1.
Validates and sanitizes user inputs to block malicious URLs or parameters that could trigger unauthorized server-side requests to internal or external resources.
Implements network boundary protections such as firewalls or proxies to restrict the application's outbound connections to only whitelisted destinations, preventing SSRF exfiltration.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB SSRF in public-facing OpenEMR enables initial access via app exploitation (T1190), forces server requests for internal system/service discovery (T1018, T1046), and supports exfiltration of config/network data via attacker-controlled HTTP/DNS OOB channels (T1567).
NVD Description
OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external…
more
or internal resources. this attack does not return a direct response but can be exploited through DNS or HTTP interactions to exfiltrate sensitive information. This vulnerability is fixed in 7.0.3.1.
Deeper analysisAI
CVE-2025-31117 is an Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability in OpenEMR, a free and open source electronic health records and medical practice management application. The flaw allows an attacker to force the OpenEMR server to make unauthorized requests to external or internal resources, without returning a direct response to the attacker. It is associated with CWE-918 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact.
Unauthenticated attackers with network access can exploit this vulnerability by triggering the server-side requests. Exploitation relies on out-of-band channels such as DNS or HTTP interactions to exfiltrate sensitive information from the server, potentially including internal network data or configuration details.
The vulnerability has been addressed in OpenEMR version 7.0.3.1, as detailed in the project's GitHub security advisory (GHSA-2pvv-ph3x-2f9h) and the corresponding fix commit (aa6f50efb2971285633fa77ea7a50949408cab12). Security practitioners should upgrade to the patched version and review access controls for any exposed OpenEMR instances.
Details
- CWE(s)