CVE-2025-0573

Executive Summary

CVE-2025-0573 is a directory traversal vulnerability in Sante PACS Server, specifically within the DCM file parsing functionality. The flaw allows remote, unauthenticated attackers to write arbitrary files to the filesystem by supplying a maliciously crafted DCM file with path traversal sequences (e.g., ../). This can lead to unauthorized file creation, potentially overwriting critical system files or planting malicious payloads. The vulnerability has a CVSS score of 5.3 (Medium) due to low impact on confidentiality and availability, but the integrity impact is partial. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for exposed instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – no data disclosure.
• Integrity Impact: Low (I:L) – limited file write capability.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to write arbitrary files without authentication could be chained with other vulnerabilities for privilege escalation or remote code execution.

Deep Dive & Mechanics

The vulnerability resides in the DCM file parser of Sante PACS Server. DCM (DICOM) files are medical imaging files that contain metadata and pixel data. The parser fails to validate user-supplied paths within the DCM file before using them in file operations. Specifically, when processing a DCM file, the server extracts a file path from the file’s metadata (e.g., in a tag like (0002,0010) or similar) and uses it to write data to disk. An attacker can craft a DCM file with a path containing directory traversal sequences (e.g., ../../../malicious.dll) to write files outside the intended directory.

The lack of proper validation means the server does not check for ../ patterns or enforce a base directory. This allows an attacker to write arbitrary files to any location the server process has write access to. Since the server runs in the context of the current user (likely a service account), the attacker can overwrite configuration files, DLLs, or executables, potentially leading to remote code execution if the overwritten file is executed later.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

// Vulnerable pseudocode
char* path = extract_dcm_tag_value(dcm_file, "TransferSyntaxUID"); // or similar
FILE* fp = fopen(path, "wb");
fwrite(data, 1, size, fp);
fclose(fp);

A patched version would sanitize the path:

// Patched pseudocode
char* path = extract_dcm_tag_value(dcm_file, "TransferSyntaxUID");
char* safe_path = sanitize_path(path, "/var/sante/pacs/data/");
if (safe_path != NULL) {
    FILE* fp = fopen(safe_path, "wb");
    fwrite(data, 1, size, fp);
    fclose(fp);
}

The sanitize_path function would resolve the path against a base directory and reject any traversal attempts.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Sante PACS Server (vulnerable version) on a Windows VM.
2. Ensure the server is listening on port 104 (DICOM default) or another configured port.
3. Use a tool like dcmtk or custom Python script to craft a malicious DCM file.

Exploitation Steps:

1. Craft a DCM file with a path traversal payload in the relevant tag. For example, set the TransferSyntaxUID tag to ../../../windows/system32/malicious.dll.
2. Embed the payload data (e.g., a DLL) in the DCM file.
3. Send the DCM file to the server using a DICOM C-STORE request.
4. The server writes the payload to the target path.
5. Trigger execution of the written file (e.g., via a scheduled task or service restart).

Example Python script (conceptual):

import pydicom
from pydicom.dataset import Dataset, FileDataset

ds = Dataset()
ds.PatientName = "Test"
ds.TransferSyntaxUID = "../../../windows/system32/malicious.dll"
# Add pixel data or other required tags
ds.PixelData = b"\x90" * 1024  # Placeholder payload

# Save as DCM file
ds.save_as("malicious.dcm")

Then use a DICOM client to send the file:

storescu -aec SANTE localhost 104 malicious.dcm

Blue Team

Detection:

• Monitor for DICOM C-STORE requests with unusual file paths in metadata.
• Look for file write events to unexpected directories (e.g., C:\Windows\System32).
• Use file integrity monitoring (FIM) on critical system directories.

Hunting:

• Search for DCM files with path traversal patterns in the TransferSyntaxUID or other tags.
• Correlate DICOM network traffic with file creation events.

Indicators of Compromise (IOCs)

• Network: DICOM C-STORE requests with path traversal sequences in metadata tags.
• File System: Unexpected files created in C:\Windows\System32, C:\Program Files, or other sensitive directories.
• Process: Sante PACS Server process (santepacs.exe) writing files outside its data directory.
• Registry: (If applicable) New service entries or startup programs pointing to written files.

Detection Engineering

YARA Rule

rule CVE_2025_0573_Directory_Traversal {
    meta:
        description = "Detects DCM files with path traversal sequences in metadata"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-0573"
    strings:
        $traversal = /\.\.\/|\.\.\\/
        $dcm_magic = { 44 49 43 4D } // "DICM"
    condition:
        $dcm_magic at 128 and $traversal
}

Sigma Rule

title: Sante PACS Server Directory Traversal via DCM File
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file write events to sensitive directories by Sante PACS Server
author: Valters IT
date: 2025-02-20
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\santepacs.exe'
        TargetFilename|contains:
            - 'C:\Windows\System32'
            - 'C:\Program Files'
            - 'C:\Users\Public'
    condition: selection
falsepositives:
    - Legitimate DICOM file storage in unusual paths (rare)
level: high

Suricata Rule

alert tcp any any -> any 104 (msg:"CVE-2025-0573 Sante PACS Server Directory Traversal"; flow:to_server,established; content:"|44 49 43 4D|"; offset:128; depth:4; content:"../"; within:1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable DICOM service if not required, or restrict network access to trusted IPs only.
• Workaround: Use a reverse proxy or WAF to inspect DICOM traffic and block path traversal patterns.
• Patch: No patch available; consider migrating to a different PACS solution if vendor remains unresponsive.
• Compensating Controls: Implement strict file system permissions to prevent the server process from writing to sensitive directories. Use AppLocker or similar to block execution from non-standard paths.
• Monitoring: Enable detailed logging for file creation events and DICOM network traffic.

Valters IT
DevSecOps & Cyber Threat Intelligence