CVE-2022-24062
📋 TL;DR
CVE-2022-24062 is a use-after-free vulnerability in Sante DICOM Viewer Pro's JP2 file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JP2 files or visiting malicious web pages. This affects users of Sante DICOM Viewer Pro 13.2.0.21165 who process medical imaging files.
💻 Affected Systems
- Sante DICOM Viewer Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation on the affected workstation, potentially compromising patient medical data and DICOM files.
If Mitigated
Application crash or denial of service if exploit fails, with potential data corruption of medical imaging files.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious file is opened. ZDI-CAN-15104 tracking suggests active research interest.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest patched version
Vendor Advisory: https://www.santesoft.com/
Restart Required: Yes
Instructions:
1. Contact Santesoft for patched version 2. Download and install update 3. Restart system 4. Verify installation
🔧 Temporary Workarounds
Disable JP2 file association
windowsRemove JP2 file type association with Sante DICOM Viewer to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .jp2 association
Application whitelisting
windowsRestrict execution of Sante DICOM Viewer to trusted directories only
🧯 If You Can't Patch
- Implement strict email/web filtering to block JP2 files from untrusted sources
- User training on not opening medical imaging files from unknown sources
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Sante DICOM Viewer for version 13.2.0.21165Check Version:
Not available via command line - check through application GUIVerify Fix Applied:
Verify installed version is newer than 13.2.0.21165 and test with known safe JP2 files📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening JP2 files
- Unexpected child processes spawned from SanteDicomViewer.exe
Network Indicators:
- Outbound connections from SanteDicomViewer.exe to unknown IPs
- Unexpected DNS queries
SIEM Query:
Process Creation where ParentImage contains 'SanteDicomViewer.exe' AND CommandLine contains unusual parameters