Vulnerability

MIM Assistant and MIM Client 7.2.10 and 7.3.3 open to XXE through DICOM RT tags

MedDevice Cyber Staff · Sep 19 · 2 min read · Via MIM Software advisory CVE-2023-3892

MIM Software disclosed CVE-2023-3892, an XML external entity (XXE) flaw (CWE-611) in MIM Assistant and the MIM Client Application. Only versions 7.2.10 and 7.3.3 are affected. MIM's own internal security testing team found it.

Exploitation takes several steps. An attacker embeds a malicious XML document in specific third party private RT object metadata tags, sends the DICOM object to MIM, and gets it archived and loaded by an Assistant rule or a user. Customers on 7.2.10 should move to 7.2.11 or higher, and those on 7.3.3 to 7.3.4 or higher. Until then, MIM advises against running the DICOM Store Service in promiscuous mode, which lets any DICOM node on the network push data in. Accepting studies from unknown AE titles was always the bigger risk.

Are you a representative of MIM Software? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade MIM Assistant and the MIM Client Application from 7.2.10 to 7.2.11 or later, or from 7.3.3 to 7.3.4 or later, to fix CVE-2023-3892. Until then, turn off promiscuous mode on the DICOM Store Service and require authorization for write access on MIM Pacs remote patient lists.

Upgrade MIM. Move 7.2.10 installs to 7.2.11+ and 7.3.3 installs to 7.3.4+.
Disable promiscuous DICOM. Configure the DICOM Store Service to accept only known, configured DICOM nodes.
Require write authorization. Make every MIM Pacs remote patient list require authorization for write access.
Harden the parser. Disable external entity resolution in any XML parsing of untrusted DICOM metadata.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

File import Hospital network

MIM Assistant

DICOM or image parsing File import

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
WatchMate Software	Anumana	Same signals	No feedback feed from manufacturer
Vitrea Software Package	Canon Medical	Same signals	No feedback feed from manufacturer
Image Suite	Carestream Health	Same signals	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same signals	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
BreView	GE HealthCare	Same signals	No feedback feed from manufacturer
EchoPAC Software Only / EchoPAC Plug-in	GE HealthCare	Same signals	No feedback feed from manufacturer
MR Contour DL	GE HealthCare	Same signals	No feedback feed from manufacturer
Image Management V15	Philips	Same signals	No feedback feed from manufacturer
OptimMRI	Rebrain	Same signals	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Glaucoma Module	Topcon Healthcare	Same signals	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Same signals	No feedback feed from manufacturer

Questions & Answers

Which MIM versions are affected by CVE-2023-3892?

Only MIM Assistant and MIM Client Application versions 7.2.10 and 7.3.3 are affected by CVE-2023-3892, an XXE flaw triggered through DICOM RT object tags.

How do I fix the MIM DICOM RT XXE vulnerability CVE-2023-3892?

MIM Software says to upgrade 7.2.10 to 7.2.11 or higher and 7.3.3 to 7.3.4 or higher. Meanwhile, do not run the DICOM Store Service in promiscuous mode and require authorization for write access to MIM Pacs remote patient lists.

← Back to Vulnerabilities