CVE-2024-28130

Executive Summary

CVE-2024-28130 is a critical vulnerability in OFFIS DCMTK version 3.6.8, specifically within the DVPSSoftcopyVOI_PList::createFromImage function. The flaw is an incorrect type conversion (CWE-704) that can be triggered by a specially crafted malformed DICOM file, leading to arbitrary code execution. With a CVSS score of 7.5 and a network-based attack vector requiring no authentication, this vulnerability poses a significant risk to healthcare and medical imaging systems that process DICOM data. No public exploit or patch is currently available, but the potential for remote code execution makes immediate mitigation essential.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM (Digital Imaging and Communications in Medicine) data. It is integrated into numerous medical imaging applications, PACS (Picture Archiving and Communication Systems), and research tools. A vulnerability in DCMTK can propagate to any downstream software that uses this library, creating a broad supply chain risk. Organizations must inventory all systems using DCMTK 3.6.8 and apply vendor patches or workarounds as soon as they become available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond receiving the malformed file.
• Scope (S): Unchanged (U) – The exploit does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Successful exploitation can lead to full disclosure of sensitive data.
• Integrity (I): High (H) – The attacker can modify data or system state.
• Availability (A): High (H) – The attacker can cause a denial of service or complete system compromise.

Threat Level: Critical. The combination of network exploitability, no authentication, and potential for arbitrary code execution makes this a high-priority vulnerability for any organization using DCMTK.

Deep Dive & Mechanics

The vulnerability resides in the DVPSSoftcopyVOI_PList::createFromImage function within DCMTK 3.6.8. This function is responsible for creating a softcopy VOI (Volume of Interest) presentation state list from an image dataset. The flaw is an incorrect type conversion, meaning the code improperly casts or interprets data types when processing malformed DICOM elements.

In DICOM, a presentation state contains attributes that define how an image should be displayed, including VOI LUT (Look-Up Table) transformations. The createFromImage function likely parses DICOM tags and constructs internal data structures. When a malformed file provides unexpected data types or values, the incorrect type conversion can lead to memory corruption, such as buffer overflows or use-after-free conditions. An attacker can craft a DICOM file with specially crafted tags that, when processed, overwrite critical memory regions, ultimately achieving arbitrary code execution.

The attack vector is network-based because DICOM is often transmitted over TCP/IP (port 11112). A malicious DICOM file can be sent directly to a listening DCMTK service or embedded in a DICOM message. No authentication is required, as DICOM services often accept connections from any source.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison cannot be provided. However, based on the CWE-704 classification, the vulnerable code likely performs an unsafe cast or conversion, such as:

// Vulnerable pseudo-code
void DVPSSoftcopyVOI_PList::createFromImage(DcmItem &dataset) {
    // Incorrect type conversion
    int value = (int)dataset.getTagValue(DCM_VOILUTFunction);
    // Use value without validation
}

A patched version would include proper type checking and bounds validation:

// Patched pseudo-code
void DVPSSoftcopyVOI_PList::createFromImage(DcmItem &dataset) {
    // Safe type conversion with validation
    Sint32 value;
    if (dataset.findAndGetSint32(DCM_VOILUTFunction, value).good()) {
        // Use value safely
    } else {
        // Handle error
    }
}

Until an official patch is released, users should apply input validation and sanitization to all DICOM data processed by DCMTK.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Deploy a virtual machine running a DICOM service using DCMTK 3.6.8 (e.g., dcmqrscp or a custom application).
2. Tooling: Use a DICOM toolkit (e.g., dcmtk command-line tools) to craft malformed files. Python with pydicom can also be used.
3. Exploit Development: Since no public exploit exists, the attacker must reverse-engineer the vulnerable function. Use a debugger (GDB, WinDbg) to analyze memory corruption. The goal is to overwrite a function pointer or return address to redirect execution to shellcode.

Example Crafting Script (Python):

import pydicom
from pydicom.dataset import Dataset, FileDataset

# Create a minimal DICOM file
ds = Dataset()
ds.PatientName = "Test"
ds.StudyInstanceUID = "1.2.3.4.5.6.7.8.9"
ds.SeriesInstanceUID = "1.2.3.4.5.6.7.8.9.1"
ds.SOPInstanceUID = "1.2.3.4.5.6.7.8.9.2"
ds.Modality = "CT"

# Add malformed VOI LUT data (triggering type conversion)
# This is a placeholder - actual exploitation requires specific memory layout
ds.add_new(0x0028, 0x3010, 'LO', 'MALFORMED_DATA')

# Save as DICOM file
ds.save_as("malformed.dcm")

Exploitation Steps:

1. Send the malformed DICOM file to the target service.
2. Monitor for crashes or abnormal behavior.
3. Iterate on the payload to achieve code execution.

Blue Team (Defensive)

Detection:

• Monitor DICOM traffic for malformed or unusual data patterns.
• Use network intrusion detection systems (NIDS) to flag DICOM messages with unexpected tag values.
• Implement application-level input validation to reject malformed DICOM files.

Mitigation:

• Isolate DICOM services on segmented networks.
• Apply strict access controls to DICOM endpoints.
• Use a DICOM firewall or proxy to inspect and sanitize traffic.
• Monitor for CVEs and apply patches as soon as they are released.

Indicators of Compromise (IOCs)

• Network: DICOM traffic (port 11112) containing malformed VOI LUT tags (e.g., tag (0028,3010) with unexpected data types).
• File: DICOM files with invalid or oversized attribute values, especially in presentation state related tags.
• System: Unexpected crashes or memory corruption in DCMTK-based applications.
• Process: Abnormal behavior in processes like dcmqrscp, storescp, or any application using DCMTK 3.6.8.

Detection Engineering

YARA Rule

rule CVE_2024_28130_DCMTK_Malformed_VOI {
    meta:
        description = "Detects malformed DICOM files targeting CVE-2024-28130"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28130"
    strings:
        $dicom_magic = { 44 49 43 4D } // "DICM"
        $voi_tag = { 28 00 10 30 } // Tag (0028,3010) in little-endian
        $suspicious_length = { FF FF 00 00 } // Unusually large length
    condition:
        $dicom_magic at 128 and $voi_tag and $suspicious_length
}

Sigma Rule

title: CVE-2024-28130 DCMTK Malformed DICOM File
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic containing malformed DICOM files targeting CVE-2024-28130
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: dicom
        dicom.tag: "0028,3010"
        dicom.length: "> 65535"
    condition: selection
falsepositives:
    - Legitimate large DICOM files (rare)
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2024-28130 DCMTK Malformed VOI LUT Tag"; flow:to_server,established; content:"|44 49 43 4D|"; offset:128; depth:4; content:"|28 00 10 30|"; within:4096; byte_test:2,>,65535,0,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Monitor OFFIS DCMTK for an official patch. Apply as soon as available.
2. Workaround: If patching is not possible, implement input validation to reject DICOM files with malformed VOI LUT tags. Use a DICOM sanitizer or proxy.
3. Network Segmentation: Isolate DICOM services on a separate VLAN with strict firewall rules.
4. Access Control: Restrict access to DICOM endpoints to trusted IP addresses only.
5. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
6. Backup: Ensure regular backups of critical medical imaging data.

Valters IT
DevSecOps & Cyber Threat Intelligence