Vulnerability

B. Braun OnlineSuite AP 3.0 and earlier allows unauthenticated file upload and DLL hijacking

MedDevice Cyber Staff · Oct 22 · 4 min read · Via CISA ICSMA-20-296-01

CISA published advisory ICSMA-20-296-01 on October 22, 2020, covering B. Braun OnlineSuite Version AP 3.0 and earlier. Julian Suleder, Nils Emmerich and Birk Kauer of ERNW Research GmbH and Dr. Oliver Matula of ERNW Enno Rey Netzwerke GmbH are credited with the three vulnerabilities.

CVE-2020-25172 (CWE-23, CVSS v3 8.6) is the headline. A relative path traversal lets unauthenticated attackers upload or download arbitrary files over the network. CVE-2020-25174 (CWE-427, 8.4) is DLL hijacking that lets a local attacker execute code as a high-privileged user. CVE-2020-25170 (CWE-1236, 6.9) is Excel macro injection through multiple input fields mishandled in the export feature.

CISA's risk evaluation strings them together: privilege escalation, arbitrary file download and upload, and remote code execution. A traversal that writes files gives an attacker a way to plant a DLL, and a search-path flaw gives that DLL a high-privileged process to load into.

The export flaw targets a different victim. A poisoned field becomes a formula in the spreadsheet an administrator opens later, which is why the vector needs high privileges and user interaction but has a changed scope.

B. Braun recommends applying its update and directs users to their local B. Braun organization and its security advisory. Any server that accepts a path from an unauthenticated client needs to canonicalize it before touching the disk.

Are you a representative of B. Braun? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the B. Braun update for OnlineSuite Version AP 3.0 and earlier, available through your local B. Braun organization and described in the B. Braun Security Advisory. Until it is installed, restrict network access to the OnlineSuite server, and treat Excel exports from the product as untrusted content.

Install the B. Braun update. Contact your local B. Braun organization and apply the update to every OnlineSuite AP 3.0 or earlier installation.
Restrict access to the server. Limit which hosts can reach OnlineSuite, since CVE-2020-25172 needs no authentication.
Lock down the install directory. Make sure only administrators can write to folders on the application's DLL search path.
Open exports with macros disabled. Treat spreadsheets from the export feature as untrusted until the update is in place.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

File import

Contributing

Named operating system Hospital network

OnlineSuite

File import

Fix the class in your product

The server accepts an uploaded file and lets it execute. As the maker, validate type by content, store uploads under a server-generated name in a non-executable location outside the web root, and serve them back through a handler that never interprets them.

Validate by content. Check magic bytes, not the extension; cap size and scan on ingest.
Store inert and non-executable. Server-generated name, no-exec directory, outside the web root.
Never execute an upload. Serve through a handler that returns bytes, never interprets them.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Monaco RTP System	Elekta	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
VELYS Hip Navigation	Johnson & Johnson MedTech	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Contour ProtégéAI+	MIM Software	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
syngo.via View&GO	Siemens Healthineers	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Philips IntelliSpace Cardiovascular	Philips	Same signals	No feedback feed from manufacturer
Image Suite	Carestream Health	Exposed to the same EMB3D threatTID-323	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Exposed to the same EMB3D threatTID-323	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Exposed to the same EMB3D threatTID-323	No feedback feed from manufacturer
Novo	PathAI	Exposed to the same EMB3D threatTID-323	No feedback feed from manufacturer

5 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-25172 in B. Braun OnlineSuite?

CVE-2020-25172 is a relative path traversal in B. Braun OnlineSuite Version AP 3.0 and earlier that lets unauthenticated attackers upload or download arbitrary files. CISA advisory ICSMA-20-296-01, published October 22, 2020, scores it 8.6 under CVSS v3.

Who found the B. Braun OnlineSuite vulnerabilities?

CISA advisory ICSMA-20-296-01 credits Julian Suleder, Nils Emmerich and Birk Kauer of ERNW Research GmbH and Dr. Oliver Matula of ERNW Enno Rey Netzwerke GmbH with CVE-2020-25172, CVE-2020-25174 and CVE-2020-25170 in B. Braun OnlineSuite AP 3.0 and earlier.

How do I fix the B. Braun OnlineSuite DLL hijacking flaw CVE-2020-25174?

B. Braun recommends applying its update for OnlineSuite Version AP 3.0 and earlier and asks users to contact their local B. Braun organization for help, per CISA advisory ICSMA-20-296-01. CVE-2020-25174 lets local attackers execute code as a high-privileged user.

← Back to Vulnerabilities