Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation
Title: Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation
Advisory ID: ZSL-2016-5379
Type: Local/Remote
Impact: Privilege Escalation
Risk: (2/5)
Release Date: 16.12.2016
Microsoft Windows 7 Ultimate SP1 (EN)
[28.11.2016] Vendor contacted.
[28.11.2016] Vendor responds asking more details.
[28.11.2016] Sent details to the vendor.
[01.12.2016] Asked vendor for status update.
[01.12.2016] Vendor confirms the vulnerability both under Windows and Linux.
[02.12.2016] Vendor creates a patch for DCMTK 3.6.0 and for the Windows service.
[13.12.2016] Vendor releases version 1.2.0 to address these issues.
[16.12.2016] Coordinated public security advisory released.
[2] https://cxsecurity.com/issue/WLB-2016120097
[3] https://packetstormsecurity.com/files/140187
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/119859
[20.12.2016] - Added reference [2] and [3]
[24.12.2016] - Added reference [4]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2016-5379
Type: Local/Remote
Impact: Privilege Escalation
Risk: (2/5)
Release Date: 16.12.2016
Summary
Orthanc is a Belgian, open-source, lightweight RESTful DICOM server for healthcare and medical research with an ubiquitous web interface that enables you to upload, receive and transfer DICOM images. It comes with a REST API to automate imaging flows and an SDK to integrate with native applications.Description
The application suffers from an unquoted search path issue impacting the service 'orthanc' for Windows deployed as part of Orthanc DICOM server solution. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.Vendor
Sébastien Jodogne - http://www.orthanc-server.comAffected Version
1.1.0Tested On
Microsoft Windows 7 Professional SP1 (EN)Microsoft Windows 7 Ultimate SP1 (EN)
Vendor Status
[22.11.2016] Vulnerability discovered.[28.11.2016] Vendor contacted.
[28.11.2016] Vendor responds asking more details.
[28.11.2016] Sent details to the vendor.
[01.12.2016] Asked vendor for status update.
[01.12.2016] Vendor confirms the vulnerability both under Windows and Linux.
[02.12.2016] Vendor creates a patch for DCMTK 3.6.0 and for the Windows service.
[13.12.2016] Vendor releases version 1.2.0 to address these issues.
[16.12.2016] Coordinated public security advisory released.
PoC
orthanc_usp.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://bitbucket.org/sjodogne/orthanc/src/Orthanc-1.2.0/NEWS?fileviewer=file-view-default[2] https://cxsecurity.com/issue/WLB-2016120097
[3] https://packetstormsecurity.com/files/140187
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/119859
Changelog
[16.12.2016] - Initial release[20.12.2016] - Added reference [2] and [3]
[24.12.2016] - Added reference [4]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
