An authenticated Server-Side Request Forgery vulnerability in OpenEMR versions prior to 8.0.0.2 allows attackers to perform unauthorized requests from the server.

The vulnerability is a Server-Side Request Forgery (CWE-918) located in the PDF creation function, where form answers are parsed as unescaped HTML. It requires an attacker to possess at least the Notes - my encounters role to trigger the flaw.

Successful exploitation allows an attacker to interact with internal network resources that are otherwise inaccessible from the public internet, potentially leading to unauthorized data exposure or internal service disruption. With a CVSS score of 7.6, this vulnerability poses a significant risk to the confidentiality and integrity of medical practice management environments.

Immediate Action: Upgrade to OpenEMR version 8.0.0.2 or later to apply the necessary security patches and input sanitization.

Proactive Monitoring: Monitor server access logs for anomalous outgoing requests originating from the web server, particularly those directed toward internal IP addresses or sensitive infrastructure.

Compensating Controls: Implement strict egress filtering on the web server to restrict outbound connections to only necessary external endpoints, effectively limiting the reach of an SSRF attack.

Public Exploit Available: No (exploit_available: unknown).

Given the potential for internal network reconnaissance and unauthorized resource interaction, organizations running OpenEMR should prioritize updating to version 8.0.0.2 immediately. Restricting access to the vulnerable module and enforcing strict network segmentation will further reduce the attack surface until the update is successfully deployed.