CVE-2024-1630: GE HealthCare Path Traversal Vulnerability

CVE-2024-1630 Overview

CVE-2024-1630 is a path traversal vulnerability [CWE-22] in the getAllFolderContents function of Common Service Desktop, a component shipped with GE HealthCare ultrasound devices. An attacker with local access to an affected device can supply crafted path input to the function and read or modify files outside the intended directory. The flaw affects confidentiality and integrity of files on the device, including clinical and configuration data used by the ultrasound platform. GE HealthCare tracks this issue through its product security portal and has published mitigation guidance for affected ultrasound product families.

Critical Impact
Local attackers can traverse the file system through the getAllFolderContents function and access or tamper with sensitive files on GE HealthCare ultrasound devices.

Affected Products

GE HealthCare Common Service Desktop (ultrasound device service component)
GE HealthCare ultrasound devices bundling the vulnerable Common Service Desktop build
Refer to the GE Healthcare Security Update portal for the authoritative list of affected models and builds

Discovery Timeline

2024-05-14 - CVE-2024-1630 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1630

Vulnerability Analysis

The vulnerability resides in the getAllFolderContents function exposed by Common Service Desktop. The function accepts a folder path parameter and returns the contents of that folder. It does not properly validate or canonicalize the supplied path before use. An attacker can inject relative traversal sequences such as ..\ or absolute paths to reach directories outside the intended service scope.

Exploitation requires local access to the device, but no authentication and no user interaction. Successful abuse yields high impact to confidentiality and integrity, while availability remains unaffected. On a medical ultrasound platform, the accessible file system typically holds patient study data, calibration files, service logs, and application binaries, making unauthorized read and write operations particularly consequential.

Root Cause

The root cause is missing input validation on the folder path argument passed to getAllFolderContents. The function trusts caller-supplied paths and does not enforce a canonical base directory or reject traversal sequences. This is a textbook Improper Limitation of a Pathname to a Restricted Directory weakness [CWE-22].

Attack Vector

An attacker with local access to the ultrasound device, such as a physically present operator or a service technician, invokes the Common Service Desktop interface and calls getAllFolderContents with a path containing traversal sequences. The service resolves the path relative to its own working directory and returns file listings from arbitrary locations. Follow-on operations exposed by the same interface can be used to read or modify the discovered files. Technical details, affected builds, and remediation steps are published at the GE Healthcare Security Update portal.

Detection Methods for CVE-2024-1630

Indicators of Compromise

Service or application logs from Common Service Desktop containing folder path arguments with ..\, ../, or absolute path prefixes
Access to files or directories outside the Common Service Desktop working directory tree by the service process
Unexpected read or write access to patient study directories, calibration data, or system configuration files on the ultrasound host

Detection Strategies

Enable and forward Common Service Desktop application and OS-level file access logs to a central log store for analysis
Alert on any invocation of getAllFolderContents where the path argument contains traversal metacharacters or references paths outside the approved service directory
Correlate service account file access with expected clinical workflow patterns to surface anomalous file enumeration

Monitoring Recommendations

Baseline normal file access paths for the Common Service Desktop process and alert on deviations
Monitor local console and service technician sessions on ultrasound hosts, especially outside scheduled maintenance windows
Track integrity of clinical, configuration, and binary files on the device with periodic hash comparison against known-good baselines

How to Mitigate CVE-2024-1630

Immediate Actions Required

Inventory all GE HealthCare ultrasound devices and identify units running Common Service Desktop builds referenced in the vendor advisory
Restrict physical and console access to affected devices to authorized clinical and service personnel only
Apply vendor-supplied updates and configuration changes as soon as they are made available for each affected product family

Patch Information

GE HealthCare publishes fixed builds and product-specific remediation instructions through its coordinated security update site. Consult the GE Healthcare Security Update portal for the current patch status, service bulletins, and installation procedures tied to CVE-2024-1630.

Workarounds

Enforce strict physical access controls on ultrasound devices, including locked rooms, badge access, and session logout after use
Disable or restrict access to Common Service Desktop functionality to authorized service accounts where operationally feasible
Segment ultrasound devices onto isolated clinical VLANs and block non-essential local peripheral access such as unauthorized USB storage

bash

# Configuration example
# Refer to the GE Healthcare Security Update portal for vendor-approved
# hardening and patching procedures for the affected ultrasound product.
# https://securityupdate.gehealthcare.com/