CVE-2025-58094
📋 TL;DR
This vulnerability allows attackers to execute arbitrary JavaScript code in users' browsers through specially crafted URLs targeting the config.php functionality in MedDream PACS Premium. It affects healthcare organizations using this medical imaging software, potentially compromising patient data and system integrity. The attack requires tricking authenticated users into clicking malicious links.
💻 Affected Systems
- MedDream PACS Premium
📦 What is this software?
Pacs Server by Meddream
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through session hijacking, credential theft, and installation of persistent malware leading to data exfiltration of sensitive medical records.
Likely Case
Session hijacking allowing unauthorized access to patient medical images and records, potentially leading to data manipulation or theft.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only causing temporary disruption.
🎯 Exploit Status
Requires user interaction (clicking malicious link) but exploitation is straightforward once the URL is crafted
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2271
Restart Required: No
Instructions:
1. Contact MedDream vendor for patch availability
2. Apply vendor-provided security update
3. Test in non-production environment first
4. Deploy to production systems
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for the worklistsrc parameter
Implement proper input sanitization in config.php for worklistsrc parameter
Content Security Policy
allImplement strict Content Security Policy headers to limit script execution
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious parameter values
- Restrict access to config.php functionality to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Test by attempting to inject JavaScript payloads into the worklistsrc parameter of config.php URLsCheck Version:
Check MedDream PACS version in administration interface or configuration filesVerify Fix Applied:
Verify that JavaScript payloads in worklistsrc parameter are properly sanitized and do not execute📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in config.php access logs
- JavaScript code patterns in URL parameters
Network Indicators:
- HTTP requests with suspicious script tags in worklistsrc parameter
- Multiple failed XSS attempts
SIEM Query:
source="web_logs" AND uri="*config.php*" AND param="*worklistsrc*" AND (value="*<script>*" OR value="*javascript:*")