CVE-2025-58091
📋 TL;DR
Multiple reflected cross-site scripting vulnerabilities in MedDream PACS Premium allow attackers to execute arbitrary JavaScript code via specially crafted URLs targeting the thumbnaildir parameter. This affects users of MedDream PACS Premium 7.3.6.870 who access malicious links, potentially leading to session hijacking or credential theft.
💻 Affected Systems
- MedDream PACS Premium
📦 What is this software?
Pacs Server by Meddream
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full system access, and compromise patient medical data integrity and confidentiality.
Likely Case
Attackers hijack user sessions, steal authentication cookies, and perform unauthorized actions within the PACS system.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting individual user sessions.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2271
Restart Required: No
Instructions:
1. Contact MedDream vendor for patch availability 2. Apply vendor-provided security update 3. Verify fix implementation
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for thumbnaildir parameter
Modify config.php to sanitize thumbnaildir input using htmlspecialchars() or similar functions
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' header to web server configuration
🧯 If You Can't Patch
- Implement web application firewall with XSS protection rules
- Restrict access to config.php functionality to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Test thumbnaildir parameter with XSS payloads like <script>alert('test')</script> and check if script executesCheck Version:
Check MedDream version in admin interface or configuration filesVerify Fix Applied:
Retest with XSS payloads after implementing fixes to confirm no script execution📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests to config.php with script tags in thumbnaildir parameter
- Multiple failed XSS attempts in web logs
Network Indicators:
- HTTP requests containing script tags or JavaScript code in URL parameters
SIEM Query:
source="web_logs" AND uri="*config.php*" AND (thumbnaildir="*<script>*" OR thumbnaildir="*javascript:*")