CVE-2023-33466 – This vulnerability in Orthanc allows authentica... (How to Fix)

Q: What is the severity of CVE-2023-33466?

CVE-2023-33466 has a CVSS score of 8.8 (HIGH). This vulnerability in Orthanc allows authenticated users with API access to overwrite arbitrary files on the file system. In specific deployment scenarios, attackers can overwrite the configuration file to achieve remote code execution. All Orthanc deployments before version 1.12.0 are affected.

📋 TL;DR

This vulnerability in Orthanc allows authenticated users with API access to overwrite arbitrary files on the file system. In specific deployment scenarios, attackers can overwrite the configuration file to achieve remote code execution. All Orthanc deployments before version 1.12.0 are affected.

💻 Affected Systems

Products:

Orthanc

Versions: All versions before 1.12.0

Operating Systems: All platforms running Orthanc

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated API access. Specific deployment scenarios where configuration file is accessible are needed for RCE.

📦 What is this software?

Orthanc by Orthanc Server

View all CVEs affecting Orthanc →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Unauthorized file modification leading to service disruption, data corruption, or privilege escalation.

🟢

If Mitigated

Limited to authenticated users only, with proper access controls preventing configuration file access.

🌐 Internet-Facing: HIGH - Internet-facing Orthanc instances with authenticated users are directly exploitable.

🏢 Internal Only: MEDIUM - Internal deployments still vulnerable to insider threats or compromised accounts.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.12.0 and later

Vendor Advisory: https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deployments-running-versions-before-1-12-0/3568

Restart Required: Yes

Instructions:

1. Backup current Orthanc configuration and data. 2. Download Orthanc 1.12.0 or later from official sources. 3. Stop Orthanc service. 4. Install the new version. 5. Restart Orthanc service. 6. Verify functionality.

🔧 Temporary Workarounds

Restrict API Access

all

Limit Orthanc API access to trusted networks and users only

Configure firewall rules to restrict access to Orthanc API port (default 8042)
Implement IP whitelisting for API endpoints

File Permission Hardening

linux

Set strict file permissions on Orthanc configuration and critical files

chmod 600 /etc/orthanc/orthanc.json
chown orthanc:orthanc /etc/orthanc/orthanc.json

🧯 If You Can't Patch

Implement strict network segmentation to isolate Orthanc instances
Enforce multi-factor authentication and strong password policies for all Orthanc users

🔍 How to Verify

Check if Vulnerable:

Check Orthanc version via web interface at /system or API endpoint /system

Check Version:

curl -X GET http://localhost:8042/system | grep Version

Verify Fix Applied:

Verify version is 1.12.0 or higher and test that file overwrite attempts via API are blocked

📡 Detection & Monitoring

Log Indicators:

Multiple failed file write attempts via API
Unauthorized configuration file modification attempts
Unusual API access patterns from non-standard IPs

Network Indicators:

Unusual volume of PUT/POST requests to Orthanc API endpoints
Traffic to Orthanc API from unexpected sources

SIEM Query:

source="orthanc.log" AND ("PUT /instances" OR "POST /instances") AND response_code=200 AND file_path CONTAINS "/etc/"

📊 Metadata

CVE ID: CVE-2023-33466

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: June 29, 2023

Last Updated: November 26, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-33466, you might also want to check these: