INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
An attacker could exploit this vulnerability by uploading arbitrary
files via the a specific endpoint, leading to unauthorized remote code
execution or system compromise.
INFINITT recommends the following mitigations:
The latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.
INFINITT ULite is NOT affected by these vulnerabilities. However, if
INFINITT ULite is operating as an integrated system with INFINITT PACS,
patching is required to secure the PACS environment.
* Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.
* Network Security Recommendations: Minimize network exposure for PACS
servers, ensuring they are not directly accessible from the internet.
* Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)
Configurations
Workarounds
Exploits
Credits
finder
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.