CVE-2020-29165
📋 TL;DR
CVE-2020-29165 is an incorrect access control vulnerability in PacsOne Server that allows remote attackers to gain administrator privileges. This affects all PacsOne Server installations below version 7.1.1. The vulnerability enables complete system compromise through privilege escalation.
💻 Affected Systems
- PacsOne Server (PACS Server In One Box)
📦 What is this software?
Pacsone Server by Rainbowfishsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with administrative access, allowing data theft, system modification, and potential ransomware deployment across the entire PACS infrastructure.
Likely Case
Unauthorized access to sensitive medical imaging data (DICOM files), patient records, and system configuration with ability to disrupt medical workflows.
If Mitigated
Limited impact if proper network segmentation, authentication controls, and monitoring are in place to detect unauthorized access attempts.
🎯 Exploit Status
Public proof-of-concept code is available, making exploitation straightforward. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.1 and above
Vendor Advisory: https://pacsone.net/download.htm
Restart Required: Yes
Instructions:
1. Download PacsOne Server version 7.1.1 or later from the vendor website. 2. Backup current configuration and data. 3. Stop the PacsOne Server service. 4. Install the updated version. 5. Restart the service and verify functionality.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to PacsOne Server to only trusted medical imaging workstations and administrators
Enhanced Monitoring
allImplement strict logging and monitoring for unauthorized access attempts and privilege escalation activities
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PacsOne Server from other critical systems
- Deploy application-level firewall rules to block suspicious API calls and enforce strict authentication requirements
🔍 How to Verify
Check if Vulnerable:
Check the PacsOne Server version in the web interface or configuration files. Versions below 7.1.1 are vulnerable.Check Version:
Check the web interface at http://[server-ip]/admin or examine the application configuration files for version information.Verify Fix Applied:
Verify the installed version is 7.1.1 or higher and test that unauthorized privilege escalation is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to administrative endpoints
- Multiple failed login attempts followed by successful administrative access
- Unusual user privilege changes
Network Indicators:
- HTTP requests to administrative endpoints from unauthorized IP addresses
- Unusual API calls to privilege escalation endpoints
SIEM Query:
source="pacsone" AND (event_type="admin_access" OR event_type="privilege_change") AND user NOT IN [authorized_admin_users]