CVE-2023-40150: Softneta Meddream PACS RCE Vulnerability

CVE-2023-40150 Overview

CVE-2023-40150 is a critical authentication bypass vulnerability affecting Softneta MedDream PACS, a Picture Archiving and Communication System used in healthcare environments for managing medical imaging data. The vulnerability exists because the application does not perform an authentication check before executing dangerous functionality, allowing unauthenticated attackers to achieve remote code execution on affected systems.

Critical Impact

Unauthenticated attackers can remotely execute arbitrary code on vulnerable Softneta MedDream PACS installations, potentially compromising sensitive medical imaging data and healthcare infrastructure.

Affected Products

• Softneta MedDream PACS Premium Edition
• Healthcare imaging systems running vulnerable MedDream PACS versions
• Medical infrastructure utilizing unpatched MedDream PACS deployments

Discovery Timeline

• 2023-09-11 - CVE-2023-40150 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-40150

Vulnerability Analysis

This vulnerability is classified under CWE-749 (Exposed Dangerous Method or Function), indicating that the application exposes functionality that should be restricted but is instead accessible without proper authentication controls. The flaw allows remote attackers to interact with dangerous application functions without providing valid credentials, leading to arbitrary code execution on the target system.

The network-based attack vector means that any attacker with network access to the vulnerable MedDream PACS instance can exploit this vulnerability. No user interaction is required, and the attacker does not need any prior privileges or authentication tokens to successfully compromise the system. This makes the vulnerability particularly dangerous in healthcare environments where PACS systems may be accessible across hospital networks or potentially exposed to the internet.

Root Cause

The root cause of CVE-2023-40150 lies in the absence of proper authentication verification before allowing access to sensitive or dangerous functionality within the MedDream PACS application. The system fails to validate that requests originate from authenticated users before processing operations that can lead to code execution, violating the fundamental security principle of defense in depth.

Attack Vector

The attack can be conducted remotely over the network without requiring any form of authentication. An attacker can directly access the exposed dangerous functionality and execute arbitrary code on the vulnerable system. The exploitation path involves:

1. Identifying a vulnerable MedDream PACS instance accessible over the network
2. Sending crafted requests to the exposed dangerous functions
3. Achieving code execution without presenting valid authentication credentials

The vulnerability affects the confidentiality, integrity, and availability of the system, as successful exploitation grants the attacker full control over the PACS server and access to sensitive medical imaging data.

For detailed technical information, refer to the CISA Medical Advisory ICSMA-23-248-01.

Detection Methods for CVE-2023-40150

Indicators of Compromise

• Unexpected processes spawned by the MedDream PACS application or its associated web server
• Unusual network connections originating from the PACS server to external IP addresses
• Authentication bypass attempts in web server access logs without corresponding authentication events
• Suspicious file modifications or new files created in the MedDream PACS installation directories

Detection Strategies

• Monitor web server logs for requests to sensitive endpoints without prior authentication events
• Deploy network intrusion detection systems (NIDS) to identify exploitation attempts targeting MedDream PACS
• Implement application-level logging to capture all requests to dangerous functionality endpoints
• Use endpoint detection and response (EDR) solutions to identify post-exploitation activities

Monitoring Recommendations

• Enable comprehensive audit logging on all MedDream PACS instances and forward logs to a centralized SIEM
• Monitor for anomalous process creation events on servers hosting MedDream PACS
• Set up alerts for any unauthenticated access attempts to administrative or sensitive functionality
• Regularly review access patterns to identify potential reconnaissance or exploitation attempts

How to Mitigate CVE-2023-40150

Immediate Actions Required

• Identify all Softneta MedDream PACS installations in your healthcare environment
• Implement network segmentation to restrict access to PACS systems from untrusted networks
• Apply vendor-provided security patches as soon as they become available
• Consider taking vulnerable systems offline if they cannot be immediately patched and are exposed to untrusted networks

Patch Information

Organizations should consult the CISA Medical Advisory ICSMA-23-248-01 for specific remediation guidance and contact Softneta directly for information about security updates and patched versions of MedDream PACS.

Workarounds

• Restrict network access to MedDream PACS systems using firewall rules, allowing only trusted IP addresses
• Place MedDream PACS behind a reverse proxy with strong authentication requirements
• Implement a web application firewall (WAF) to filter malicious requests before they reach the application
• Disable or block access to dangerous functionality endpoints until patches can be applied

# Example network isolation using iptables
# Restrict access to MedDream PACS port to authorized networks only
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP