Orthanc Osimis DICOM Web Viewer runs JavaScript planted in an uploaded study

MedDevice Cyber Staff · Jan 23 · 2 min read · Via CISA ICSMA-24-023-01

CISA published advisory ICSMA-24-023-01 on January 23, 2024, for CVE-2023-7238 in the Orthanc Osimis DICOM Web Viewer, version 1.4.2.0-9d9eff4. Noam Moshe of Claroty Team82 reported it. The weakness is cross-site scripting (CWE-79) with a CVSS v3.1 base score of 7.1.

An attacker uploads a DICOM study carrying an XSS payload. When a user opens that study in the Osimis WebViewer, the payload runs as arbitrary JavaScript in the victim's browser.

The vector needs user interaction, and opening studies is exactly what a viewer is for. The scope is changed, since the code runs in the user's browser session outside the viewer's own component.

Orthanc recommends updating its Docker images and Windows installers to Orthanc version 24.1.2 or greater and published details in its security bulletin. CISA reported no known public exploitation specifically targeting the flaw at the time.

Every field in an imported study is attacker-controlled input, and a web viewer that renders it without encoding hands the attacker the reader's browser.

Are you a representative of Orthanc? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Orthanc Docker images and Windows installers to Orthanc 24.1.2 or greater, which addresses CVE-2023-7238 in the Osimis WebViewer. Until then, treat studies from untrusted sources as hostile and limit who can upload to the archive. Developers of DICOM viewers should encode every study field before rendering it.

Upgrade to Orthanc 24.1.2. Replace Docker images and Windows installers running Osimis WebViewer 1.4.2.0-9d9eff4.
Restrict study uploads. Limit write access to the Orthanc server to known modalities and staff.
Encode DICOM fields on output. Viewer developers should treat every tag value as untrusted text when building the page.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface DICOM or image parsing

Contributing

File import

Osimis WebViewer

PID-311 Web interface DICOM or image parsing File import

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2023-7238 in the Orthanc Osimis WebViewer?

CVE-2023-7238 (CWE-79, CVSS v3.1 7.1) is a cross-site scripting flaw in the Orthanc Osimis DICOM Web Viewer 1.4.2.0-9d9eff4. A DICOM study uploaded with an XSS payload runs arbitrary JavaScript in the browser of a user who views it. CISA disclosed it in ICSMA-24-023-01 on January 23, 2024.

How do I fix the Orthanc Osimis WebViewer XSS vulnerability?

Orthanc recommends updating the Docker images and Windows installers to Orthanc version 24.1.2 or greater to address CVE-2023-7238 in the Osimis WebViewer, per CISA advisory ICSMA-24-023-01.

← Back to Vulnerabilities

Sources

Orthanc: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Orthanc