CVE-2025-0572

Executive Summary

CVE-2025-0572 is a directory traversal vulnerability in Sante PACS Server Web Portal, specifically during the parsing of DCM (Digital Imaging and Communications in Medicine) files. The flaw allows an authenticated remote attacker to write arbitrary files to the filesystem by supplying a crafted path in a DCM file. The vulnerability arises from insufficient validation of user-supplied paths before file operations, enabling an attacker to escape the intended directory and write files outside the web root. With a CVSS score of 4.3 (Medium), the impact is limited to file creation in the context of the current user, but it could be chained with other vulnerabilities for privilege escalation or remote code execution. No public exploit code or patch is currently available, and the vendor has not released a fix.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary medical imaging server (Sante PACS Server) and is not part of a public software supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Authentication required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Arbitrary file write
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication, but the low complexity and network attack vector make it attractive for post-authentication attacks. The ability to write arbitrary files could lead to further compromise, such as overwriting configuration files or planting web shells.

Deep Dive & Mechanics

The vulnerability exists in the Sante PACS Server Web Portal component responsible for parsing DCM files. DCM files are medical imaging files that contain metadata and pixel data. The parsing logic extracts file paths from the DCM file (e.g., from tags like (0008,0018) or custom fields) and uses them in file operations without proper validation.

Root Cause: The application fails to sanitize user-supplied paths, allowing path traversal sequences (e.g., ../) to escape the intended directory. When a DCM file is processed, the server constructs a file path based on the DCM content and writes data to that location. An attacker can craft a DCM file with a malicious path like ../../../../tmp/evil.txt to write files outside the web root.

Attack Flow:

1. Attacker authenticates to the Sante PACS Web Portal.
2. Attacker uploads a specially crafted DCM file containing a path traversal payload in a relevant tag.
3. The server parses the DCM file and uses the attacker-supplied path to write data (e.g., pixel data or metadata) to the filesystem.
4. The file is written to an arbitrary location, potentially overwriting critical files or creating a web shell.

Impact: Arbitrary file write in the context of the current user. This could be used to:

• Overwrite configuration files (e.g., web.config, application settings).
• Write a malicious script to a web-accessible directory (if the user has write permissions).
• Plant a cron job or startup script for persistence.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

# Vulnerable: Direct use of user-supplied path from DCM file
dcm_file = parse_dicom(uploaded_file)
output_path = dcm_file.get_tag("PathTag")  # e.g., "output/../malicious.txt"
with open(output_path, "w") as f:
    f.write(dcm_file.get_pixel_data())

Patched Code (Conceptual):

# Patched: Validate and sanitize the path
import os
dcm_file = parse_dicom(uploaded_file)
raw_path = dcm_file.get_tag("PathTag")
# Ensure path is within allowed directory
safe_path = os.path.normpath(os.path.join("/allowed/base", raw_path))
if not safe_path.startswith("/allowed/base"):
    raise ValueError("Invalid path")
with open(safe_path, "w") as f:
    f.write(dcm_file.get_pixel_data())

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Sante PACS Web Portal.
• Ability to upload DCM files.
• Knowledge of the target filesystem (e.g., web root path).

Exploitation Steps:

1. Craft a malicious DCM file using a DICOM library (e.g., pydicom in Python).
2. Set a tag (e.g., (0008,0018) or a custom tag) to a path traversal string like ../../../../inetpub/wwwroot/shell.aspx.
3. Upload the DCM file via the web portal.
4. The server writes the file to the specified location.
5. Access the written file (e.g., http://target/shell.aspx) to execute commands.

Example DCM Creation (Python):

import pydicom
from pydicom.dataset import Dataset, FileDataset

ds = Dataset()
ds.PatientName = "Test"
ds.add_new((0x0008, 0x0018), 'UI', '../../../../inetpub/wwwroot/shell.aspx')
# Add pixel data or metadata to be written
ds.PixelData = b"<% Response.Write('pwned') %>"
# Save as DCM
ds.save_as("malicious.dcm")

Upload and Trigger:

• Use the web portal's upload functionality or API endpoint (e.g., POST /upload).
• Monitor for the file creation.

Blue Team

Detection:

• Monitor file system changes in sensitive directories (e.g., web root, system32, /etc).
• Look for DCM files with unusual path tags (e.g., containing ../).
• Alert on file writes to unexpected locations by the PACS process.

Hunting:

• Search for DCM files with non-standard tags or large metadata.
• Review logs for file write operations with path traversal patterns.
• Use file integrity monitoring (FIM) to detect unauthorized file modifications.

Mitigation:

• Restrict write permissions for the PACS service account.
• Implement input validation on all DCM tags used in file operations.
• Use a chroot jail or sandbox for the PACS process.

Indicators of Compromise (IOCs)

• File Artifacts:

  • Unexpected files in web-accessible directories (e.g., shell.aspx, cmd.jsp).
  • Modified configuration files (e.g., web.config, appsettings.json).
  • DCM files with path traversal strings in tags (e.g., ../../..).

• Network Indicators:

  • Unusual outbound connections from the PACS server (e.g., to attacker C2).
  • HTTP requests to uploaded malicious files.

• Log Indicators:

  • File write events to paths outside the expected DCM storage directory.
  • Error logs showing path traversal attempts (e.g., "Access to path denied").

Detection Engineering

YARA Rule

rule CVE_2025_0572_DCM_PathTraversal {
    meta:
        description = "Detects DCM files with path traversal patterns in tags"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-0572"
    strings:
        $traversal = /\.\.\/[^\/]/ 
        $dcm_header = { 44 49 43 4D }  // "DICM"
    condition:
        $dcm_header at 128 and any of ($traversal)
}

Sigma Rule

title: Sante PACS Server Arbitrary File Write via DCM Parsing
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects file write operations to unexpected directories by the Sante PACS process
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\santepacs.exe'
        TargetFilename|contains: 
            - '..\'
            - '..\/'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate DCM file operations with complex paths
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0572 Sante PACS DCM Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"DICM"; within:4; distance:128; content:"../"; within:3; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable DCM file upload if not required for operations.
2. Restrict write permissions for the PACS service account to only necessary directories.
3. Implement input validation on all DCM tags used in file operations (e.g., whitelist allowed paths).
4. Monitor for exploitation using the provided detection rules.

Long-Term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of Sante PACS Server.
• Conduct a security audit of the DCM parsing code.

Workaround:

• Use a reverse proxy to filter out path traversal patterns in uploaded files.
• Deploy a WAF rule to block requests containing ../ in file uploads.

Valters IT