CVE-2024-1453
📋 TL;DR
This vulnerability in Sante DICOM Viewer Pro allows attackers to execute arbitrary code or disclose information by tricking users into opening malicious DICOM files. It affects healthcare and medical imaging environments using versions 14.0.3 and earlier. The attack requires local access or user interaction with malicious files.
💻 Affected Systems
- Sante DICOM Viewer Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution, potentially leading to data theft, ransomware deployment, or lateral movement within medical networks.
Likely Case
Information disclosure from medical imaging systems or limited code execution in user context, potentially exposing patient data or disrupting medical workflows.
If Mitigated
No impact if proper security controls prevent execution of malicious files or if software is patched/isolated.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but technical complexity appears low based on CWE-125 (out-of-bounds read).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.0.4 or later (check vendor advisory)
Vendor Advisory: https://www.santesoft.com/security (check for specific advisory)
Restart Required: Yes
Instructions:
1. Download latest version from Sante website. 2. Backup configuration files. 3. Uninstall current version. 4. Install updated version. 5. Restart system.
🔧 Temporary Workarounds
Restrict DICOM file sources
allOnly allow DICOM files from trusted sources and implement file validation
User training and awareness
allTrain medical staff to only open DICOM files from trusted medical sources
🧯 If You Can't Patch
- Isolate Sante DICOM Viewer systems from network and restrict to essential users only
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Sante DICOM Viewer Pro - if version is 14.0.3 or earlier, system is vulnerableCheck Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version is 14.0.4 or later in Help > About menu📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from Sante DICOM Viewer
- Multiple failed file parsing attempts
- Unusual network connections from viewer process
Network Indicators:
- Outbound connections to suspicious IPs from viewer process
- Unexpected data exfiltration patterns
SIEM Query:
process_name:"SanteDICOMViewer.exe" AND (parent_process:explorer.exe OR cmdline:*dcm*)