CVE-2018-25298: Merge PACS 7.0 CSRF Vulnerability

CVE-2018-25298 Overview

Merge PACS 7.0 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-viewer endpoint. This vulnerability enables attackers to submit POST requests to /servlet/actions/merge-viewer/summary with login credentials to hijack user sessions and gain unauthorized access to the PACS (Picture Archiving and Communication System) system.

Critical Impact

Attackers can hijack authenticated user sessions and perform unauthorized actions on the medical imaging PACS system, potentially compromising patient data and healthcare system integrity.

Affected Products

• Merge PACS 7.0

Discovery Timeline

• 2026-04-29 - CVE-2018-25298 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2018-25298

Vulnerability Analysis

This cross-site request forgery (CSRF) vulnerability in Merge PACS 7.0 allows remote attackers to perform actions on behalf of authenticated users without their knowledge or consent. The vulnerability exists in the merge-viewer endpoint, specifically at /servlet/actions/merge-viewer/summary, which fails to implement proper CSRF token validation for state-changing POST requests.

When an authenticated user visits a malicious website containing a crafted HTML form, the attacker can silently submit requests to the vulnerable PACS endpoint. Since the application does not verify the origin of requests or validate anti-CSRF tokens, the server processes these malicious requests as if they were legitimately initiated by the authenticated user.

This vulnerability is classified under CWE-352 (Cross-Site Request Forgery), which describes weaknesses where web applications fail to sufficiently verify whether well-formed, valid, and consistent requests were intentionally provided by the user who submitted the request.

Root Cause

The root cause of this vulnerability is the absence of CSRF protection mechanisms in the Merge PACS 7.0 application. The /servlet/actions/merge-viewer/summary endpoint accepts and processes POST requests without validating:

• Anti-CSRF tokens (synchronizer tokens)
• Request origin headers (Origin or Referer validation)
• SameSite cookie attributes

This allows attackers to craft malicious HTML forms that automatically submit requests to the vulnerable endpoint when loaded in a victim's browser, leveraging the victim's authenticated session cookies.

Attack Vector

The attack is network-based and requires user interaction. An attacker must trick an authenticated Merge PACS user into visiting a malicious webpage. The attack flow involves:

1. The attacker crafts a malicious HTML page containing a hidden form targeting the vulnerable endpoint
2. The form includes fields for login credentials or other sensitive parameters
3. When an authenticated PACS user visits the malicious page, JavaScript or auto-submit functionality sends the forged request
4. The victim's browser automatically includes session cookies with the request
5. The PACS server processes the request with the victim's privileges

The vulnerability allows attackers to perform any action the victim is authorized to perform, including potentially accessing or modifying patient imaging data.

Detection Methods for CVE-2018-25298

Indicators of Compromise

• Unexpected POST requests to /servlet/actions/merge-viewer/summary with unusual Referer headers pointing to external domains
• Session activity originating from IP addresses inconsistent with the user's normal access patterns
• Multiple rapid requests to the merge-viewer endpoint from different geographic locations using the same session
• Audit logs showing administrative actions performed during times when legitimate users were not actively using the system

Detection Strategies

• Implement web application firewall (WAF) rules to flag POST requests to the merge-viewer endpoint with external or missing Referer headers
• Monitor HTTP access logs for requests to /servlet/actions/merge-viewer/summary that originate from unexpected referring domains
• Deploy network intrusion detection signatures to identify suspicious request patterns targeting the vulnerable endpoint
• Review authentication logs for anomalous session activity following visits to external websites

Monitoring Recommendations

• Enable detailed logging for all requests to the merge-viewer servlet actions
• Implement real-time alerting for CSRF-like patterns including rapid successive requests and cross-origin requests to sensitive endpoints
• Correlate web server logs with user authentication events to identify potential session hijacking attempts
• Monitor for the creation or modification of user accounts or access privileges that may indicate successful exploitation

How to Mitigate CVE-2018-25298

Immediate Actions Required

• Implement network segmentation to restrict access to the Merge PACS system to only authorized internal networks
• Deploy a web application firewall (WAF) with CSRF protection capabilities in front of the PACS application
• Educate users about the risks of clicking links or visiting untrusted websites while authenticated to the PACS system
• Review audit logs for any evidence of prior exploitation and investigate suspicious activity

Patch Information

Organizations should contact the vendor for information about available patches or updated versions that address this CSRF vulnerability. Additional technical details and exploit information are available through the Exploit-DB #44681 entry and the VulnCheck Advisory.

Workarounds

• Restrict network access to the Merge PACS application to trusted internal networks only, preventing exposure to external attack vectors
• Configure browsers used to access PACS to block third-party cookies and implement strict referrer policies
• Use dedicated browser profiles or sessions exclusively for PACS access to minimize cross-site request risks
• Implement additional authentication requirements such as re-authentication for sensitive operations within the PACS system