CVE-2022-24058
📋 TL;DR
CVE-2022-24058 is a buffer overflow vulnerability in Sante DICOM Viewer Pro that allows remote code execution when a user opens a malicious J2K image file. Attackers can exploit this to run arbitrary code with the same privileges as the current user. This affects users of Sante DICOM Viewer Pro 11.8.7.0 who open untrusted J2K files.
💻 Affected Systems
- Sante DICOM Viewer Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation or data exfiltration when users open malicious J2K files from untrusted sources.
If Mitigated
Limited impact if proper application sandboxing and user privilege restrictions are in place.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once a malicious J2K file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.8.8.0 or later
Vendor Advisory: https://www.santesoft.com/security-advisories
Restart Required: Yes
Instructions:
1. Download latest version from SanteSoft website. 2. Run installer. 3. Restart system. 4. Verify version is 11.8.8.0 or higher.
🔧 Temporary Workarounds
Disable J2K file association
windowsRemove J2K file type association with Sante DICOM Viewer to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .j2k association
Application sandboxing
windowsRun Sante DICOM Viewer in restricted environment
🧯 If You Can't Patch
- Restrict user privileges to standard user accounts (not administrator)
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Sante DICOM Viewer for version 11.8.7.0Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 11.8.8.0 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening J2K files
- Unusual process creation from SanteDICOMViewer.exe
Network Indicators:
- Downloads of J2K files from untrusted sources
- Outbound connections after J2K file opening
SIEM Query:
process_name:"SanteDICOMViewer.exe" AND (event_id:1000 OR parent_process:*powershell* OR parent_process:*cmd*)