OFFIS DCMTK flaws enable file writes, memory exhaustion
Five vulnerabilities in OFFIS DCMTK Toolkit ≤3.7.0 allow unauthenticated attackers to write arbitrary files, leak memory, access unauthorized data, or crash DICOM services in healthcare environments.
CISA disclosed five vulnerabilities affecting OFFIS DCMTK Toolkit version 3.7.0 and earlier, a widely-deployed DICOM implementation used in healthcare imaging systems worldwide. The flaws allow unauthenticated remote attackers to perform path traversal attacks to write files outside intended directories or read worklist records across departmental boundaries, exhaust server memory through crafted connection requests until the service is killed, or crash the worklist server with a single malicious query. The vulnerabilities affect both client and server components of the toolkit.
OFFIS has released fixes in the latest GitHub snapshot. Organizations are advised to upgrade immediately and implement defense-in-depth measures including network segmentation, firewall isolation, and VPN-protected remote access. The toolkit is deployed globally in healthcare and public health critical infrastructure. CISA reports no known public exploitation at this time, though the unauthenticated remote attack surface and healthcare sector targeting warrant prompt remediation.
Mentioned in this report
Detection guidance
DCMTK Server Process Writing Files Outside Expected Directory (Path Traversal)
Detects a DCMTK server component (storescp, dcmqrscp, wlmscpfs, movescu) writing a file whose path contains directory traversal sequences, consistent with exploitation of the DCMTK path traversal write vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DCMTK Server Process Writing Files Outside Expected Directory (Path Traversal)
id: 29f9a47b-0432-5641-90b2-643e535a4b88
status: experimental
description: Detects a DCMTK-related server process (storescp, dcmqrscp, wlmscpfs,
movescu) creating or writing a file whose target path includes directory traversal
sequences (../ or ..\\), matching the behaviour of the DCMTK unauthenticated path
traversal file write vulnerabilities disclosed by CISA affecting DCMTK 3.7.0 and
earlier.
references:
- https://www.cisa.gov/
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\storescp.exe
- \\dcmqrscp.exe
- \\wlmscpfs.exe
- \\movescu.exe
- \\storescu.exe
traversal:
TargetFilename|contains:
- ..\\
- ../
filter:
TargetFilename|contains:
- C:\\Program Files\\DCMTK\\
- C:\\Program Files (x86)\\DCMTK\\
condition: selection and traversal and not filter
falsepositives:
- Legitimate DICOM archive relocation scripts that intentionally use relative paths
within the configured storage tree
- Backup or migration tooling that copies DCMTK data directories using relative path
notation
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
DCMTK Worklist or Storage Service Crash Dump Following Query
Detects Windows Error Reporting (WerFault) invoked against a DCMTK worklist/storage server binary, indicating the process crashed unexpectedly, consistent with the DCMTK malicious-query crash and memory exhaustion vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DCMTK Worklist or Storage Service Crash Dump Following Query
id: e1b0366a-5251-50e3-953b-922f87348040
status: experimental
description: Detects Windows Error Reporting generating a crash report (WerFault.exe)
for a DCMTK server process (dcmqrscp, wlmscpfs, storescp), which may indicate the
process was crashed remotely via a malformed DICOM query as described in the DCMTK
worklist server crash and memory exhaustion vulnerabilities disclosed by CISA. Repeated
crashes of the same service in a short window are a stronger indicator and should
be correlated by the SIEM alerting logic rather than encoded in this rule.
references:
- https://www.cisa.gov/
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\WerFault.exe
CommandLine|contains:
- dcmqrscp
- wlmscpfs
- storescp
condition: selection
falsepositives:
- Crash of the DCMTK service caused by an unrelated local bug or resource exhaustion
unrelated to network exploitation
- Planned maintenance or forced termination of the service during upgrades
level: medium
tags:
- attack.t1499
- attack.impact
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free