CVE-2026-33321: OpenEMR SSRF Vulnerability

CVE-2026-33321 Overview

CVE-2026-33321 is an Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability discovered in OpenEMR, a free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in the PDF creation functionality where Eye Exam form answers are parsed as unescaped HTML, allowing authenticated attackers with the Notes - my encounters role to forge requests from the server to external or internal resources.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exfiltrating sensitive patient health information or pivoting to other internal systems from the OpenEMR server.

Affected Products

• OpenEMR versions prior to 8.0.0.2
• OpenEMR installations with Eye Exam form functionality enabled
• Systems where users have the Notes - my encounters role

Discovery Timeline

• 2026-03-19 - CVE CVE-2026-33321 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33321

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources based on user-supplied input without proper validation. In the context of OpenEMR, the flaw manifests in the PDF generation functionality used to export Eye Exam form data.

Users with the Notes - my encounters role have legitimate access to fill out Eye Exam forms within patient encounters. When these forms are exported to PDF format, the application processes form field answers without properly escaping or sanitizing HTML content. This allows an attacker to inject malicious HTML elements containing references to attacker-controlled or internal URLs.

The Out-of-Band (OOB) nature of this SSRF means the attacker may not receive direct responses from the forged requests but can still exfiltrate data through DNS lookups or HTTP callbacks to external servers they control. In healthcare environments, this poses significant risks as it could potentially expose protected health information (PHI) or provide attackers with reconnaissance capabilities against internal network infrastructure.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the PDF generation module. When Eye Exam form data is processed for PDF creation, the application fails to escape HTML entities in user-supplied form answers. This allows HTML tags containing external resource references (such as <img>, <iframe>, or <link> elements) to be interpreted and rendered during PDF generation, causing the server to make unintended HTTP requests to arbitrary destinations.

Attack Vector

The attack requires network access and low-privilege authentication (specifically the Notes - my encounters role). An attacker would:

1. Authenticate to OpenEMR with a user account having the Notes - my encounters permission
2. Access a patient encounter and navigate to the Eye Exam form
3. Inject malicious HTML payloads into form fields that reference internal or external URLs
4. Trigger the PDF export functionality to cause the server to process the malicious HTML
5. The server makes requests to the attacker-specified URLs, potentially leaking internal data or enabling network reconnaissance

The vulnerability does not require user interaction beyond the attacker's own actions, and the low complexity of exploitation combined with network accessibility increases the overall risk profile.

Detection Methods for CVE-2026-33321

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests originating from the OpenEMR server to external IP addresses or domains
• DNS queries from the OpenEMR server to suspicious or uncommon domains
• Eye Exam form entries containing HTML tags, especially elements like <img>, <iframe>, <script>, or <link>
• Abnormal PDF generation activity or errors in the Eye Exam module

Detection Strategies

• Implement web application firewall (WAF) rules to detect HTML injection attempts in form submissions
• Monitor application logs for PDF generation errors or unusual processing patterns
• Deploy network monitoring to detect unexpected outbound connections from the OpenEMR server
• Use intrusion detection systems (IDS) to alert on SSRF-related traffic patterns

Monitoring Recommendations

• Enable detailed logging for all PDF generation operations in OpenEMR
• Configure network egress filtering and alerting for the OpenEMR server
• Implement data loss prevention (DLP) monitoring for potential PHI exfiltration attempts
• Regularly audit user accounts with the Notes - my encounters role for suspicious activity

How to Mitigate CVE-2026-33321

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.2 or later immediately
• Audit existing Eye Exam form entries for suspicious HTML content
• Review access logs for users with the Notes - my encounters role
• Implement network egress restrictions on the OpenEMR server to limit outbound connections

Patch Information

The vulnerability has been fixed in OpenEMR version 8.0.0.2. The fix is available through the official GitHub commit (commit hash: dccc962f06bdf6105ca85c277915167caf3e7c28). Organizations should update their OpenEMR installations through standard upgrade procedures. For detailed information about the security issue, refer to the GitHub Security Advisory GHSA-5pc3-2crw-96rv.

Workarounds

• Restrict the Notes - my encounters role to only essential trusted personnel until patching is complete
• Implement network segmentation to isolate the OpenEMR server from sensitive internal resources
• Deploy a web application firewall with rules to block HTML injection in form fields
• Disable or restrict PDF export functionality for Eye Exam forms if not operationally required

# Network egress restriction example using iptables
# Limit outbound connections from OpenEMR server to essential services only
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner www-data -p tcp --dport 443 -d trusted-update-server.example.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner www-data -j LOG --log-prefix "OPENEMR_EGRESS_BLOCKED: "
iptables -A OUTPUT -m owner --uid-owner www-data -j DROP