CVE-2022-2120
📋 TL;DR
This vulnerability in OFFIS DCMTK's service class user (SCU) allows attackers to write DICOM files to arbitrary directories via relative path traversal. This could lead to remote code execution by placing malicious files in system locations. All versions prior to 3.6.7 are affected.
💻 Affected Systems
- OFFIS DCMTK
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with system-level privileges, allowing complete compromise of affected systems and potential lateral movement within networks.
Likely Case
Unauthorized file writes leading to data manipulation, denial of service, or privilege escalation through crafted DICOM files.
If Mitigated
Limited to unauthorized file writes in controlled directories without execution capabilities.
🎯 Exploit Status
Exploitation requires network access to the SCU service and knowledge of DICOM protocols, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.7
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
Restart Required: Yes
Instructions:
1. Download DCMTK version 3.6.7 or later from official sources. 2. Stop all DCMTK services. 3. Backup configuration files. 4. Install the updated version. 5. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to DCMTK SCU services to trusted sources only.
iptables -A INPUT -p tcp --dport 104 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 104 -j DROP
File System Restrictions
allConfigure DCMTK to run with minimal file system permissions and use chroot/jail environments.
chown -R dcmtk_user:dcmtk_group /var/lib/dcmtk
chmod 750 /var/lib/dcmtk
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to the DCMTK SCU service.
- Monitor file system activity for unauthorized writes and implement file integrity monitoring.
🔍 How to Verify
Check if Vulnerable:
Check DCMTK version with 'dcmtk --version' or examine installed package version. Versions below 3.6.7 are vulnerable.Check Version:
dcmtk --versionVerify Fix Applied:
Confirm version is 3.6.7 or higher using 'dcmtk --version'. Test SCU functionality with controlled DICOM transfers.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in DCMTK logs
- Path traversal patterns in DICOM request logs
- Failed file access attempts outside expected directories
Network Indicators:
- Unusual DICOM C-STORE requests with path traversal patterns
- Multiple failed DICOM association attempts followed by successful transfers
SIEM Query:
source="dcmtk.log" AND ("..\\" OR "../" OR "path traversal")