OFFIS DCMTK flaws enable file writes, memory exhaustion
Five vulnerabilities in OFFIS DCMTK Toolkit ≤3.7.0 allow unauthenticated attackers to write arbitrary files, leak memory, access unauthorized data, or crash DICOM services in healthcare environments.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA disclosed five vulnerabilities affecting OFFIS DCMTK Toolkit version 3.7.0 and earlier, a widely-deployed DICOM implementation used in healthcare imaging systems worldwide. The flaws allow unauthenticated remote attackers to perform path traversal attacks to write files outside intended directories or read worklist records across departmental boundaries, exhaust server memory through crafted connection requests until the service is killed, or crash the worklist server with a single malicious query. The vulnerabilities affect both client and server components of the toolkit.
OFFIS has released fixes in the latest GitHub snapshot. Organizations are advised to upgrade immediately and implement defense-in-depth measures including network segmentation, firewall isolation, and VPN-protected remote access. The toolkit is deployed globally in healthcare and public health critical infrastructure. CISA reports no known public exploitation at this time, though the unauthenticated remote attack surface and healthcare sector targeting warrant prompt remediation.
Mentioned in this report
Detection guidance
DCMTK Server Process Writing Files Outside Expected Directory (Path Traversal)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a DCMTK server component (storescp, dcmqrscp, wlmscpfs, movescu) writing a file whose path contains directory traversal sequences, consistent with exploitation of the DCMTK path traversal write vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DCMTK Server Process Writing Files Outside Expected Directory (Path Traversal)
id: 29f9a47b-0432-5641-90b2-643e535a4b88
status: experimental
description: Detects a DCMTK-related server process (storescp, dcmqrscp, wlmscpfs,
movescu) creating or writing a file whose target path includes directory traversal
sequences (../ or ..\\), matching the behaviour of the DCMTK unauthenticated path
traversal file write vulnerabilities disclosed by CISA affecting DCMTK 3.7.0 and
earlier.
references:
- https://www.cisa.gov/
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\storescp.exe
- \\dcmqrscp.exe
- \\wlmscpfs.exe
- \\movescu.exe
- \\storescu.exe
traversal:
TargetFilename|contains:
- ..\\
- ../
filter:
TargetFilename|contains:
- C:\\Program Files\\DCMTK\\
- C:\\Program Files (x86)\\DCMTK\\
condition: selection and traversal and not filter
falsepositives:
- Legitimate DICOM archive relocation scripts that intentionally use relative paths
within the configured storage tree
- Backup or migration tooling that copies DCMTK data directories using relative path
notation
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
DCMTK Worklist or Storage Service Crash Dump Following Query
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Windows Error Reporting (WerFault) invoked against a DCMTK worklist/storage server binary, indicating the process crashed unexpectedly, consistent with the DCMTK malicious-query crash and memory exhaustion vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DCMTK Worklist or Storage Service Crash Dump Following Query
id: e1b0366a-5251-50e3-953b-922f87348040
status: experimental
description: Detects Windows Error Reporting generating a crash report (WerFault.exe)
for a DCMTK server process (dcmqrscp, wlmscpfs, storescp), which may indicate the
process was crashed remotely via a malformed DICOM query as described in the DCMTK
worklist server crash and memory exhaustion vulnerabilities disclosed by CISA. Repeated
crashes of the same service in a short window are a stronger indicator and should
be correlated by the SIEM alerting logic rather than encoded in this rule.
references:
- https://www.cisa.gov/
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\WerFault.exe
CommandLine|contains:
- dcmqrscp
- wlmscpfs
- storescp
condition: selection
falsepositives:
- Crash of the DCMTK service caused by an unrelated local bug or resource exhaustion
unrelated to network exploitation
- Planned maintenance or forced termination of the service during upgrades
level: medium
tags:
- attack.t1499
- attack.impact
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs