Cyber Posture

CVE-2025-31117

HighPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
30 April 2025
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0185 83.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Security Summary

CVE-2025-31117 is an Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability in OpenEMR, a free and open source electronic health records and medical practice management application. The flaw allows an attacker to force the OpenEMR server to make unauthorized requests to external or internal resources, without returning a direct response to the attacker. It is associated with CWE-918 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact.

Unauthenticated attackers with network access can exploit this vulnerability by triggering the server-side requests. Exploitation relies on out-of-band channels such as DNS or HTTP interactions to exfiltrate sensitive information from the server, potentially including internal network data or configuration details.

The vulnerability has been addressed in OpenEMR version 7.0.3.1, as detailed in the project's GitHub security advisory (GHSA-2pvv-ph3x-2f9h) and the corresponding fix commit (aa6f50efb2971285633fa77ea7a50949408cab12). Security practitioners should upgrade to the patched version and review access controls for any exposed OpenEMR instances.

Details

CWE(s)
CWE-918

Affected Products

open-emr
openemr
≤ 7.0.3.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1018 Remote System Discovery Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1567 Exfiltration Over Web Service Exfiltration
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.
attack.mitre.org →
Why these techniques?

OOB SSRF in public-facing OpenEMR enables initial access via app exploitation (T1190), forces server requests for internal system/service discovery (T1018, T1046), and supports exfiltration of config/network data via attacker-controlled HTTP/DNS OOB channels (T1567).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References