DCM4CHE Medical Imaging Archive Vulnerabilities Expose Patient Data
Independent researcher discovers multiple critical flaws in the open-source DCM4CHE medical imaging archive, potentially allowing data deletion, forgery, and denial-of-service attacks.
An independent security researcher has identified several significant vulnerabilities within the widely-used open-source DCM4CHE medical imaging archive software. These flaws could allow malicious actors to compromise patient data integrity and availability, with potential impacts ranging from the deletion of critical imaging studies to the injection of fabricated medical records.
Researcher Abhinav Agarwal detailed findings in GitHub Security Advisories, highlighting a critical mass deletion vulnerability. This flaw could enable an attacker to remove patient imaging scans that are essential for clinical diagnosis and comparative studies. The archive might incorrectly report the study as available even after the image file has been deleted, leading to retrieval errors and potential gaps in patient care.
Beyond data deletion, Agarwal's research also uncovered multiple denial-of-service (DoS) vulnerabilities. These include issues related to infinite loops in JPEGParser and MP4Parser, as well as an inefficient boundary scanning flaw in MultipartInputStream. Exploitation of these vulnerabilities could exhaust the PACS/archive's processing capacity, rendering the service unavailable to legitimate users and causing significant operational disruptions within healthcare facilities.
Further concerns arise from two additional vulnerabilities related to unauthenticated DICOM and HL7 access, which were still in draft status with the DCM4CHE vendor at the time of reporting. These flaws could permit attackers to inject forged studies into a patient's record, reassign imaging studies to incorrect patient identities, or even withhold a patient's complete medical record. Agarwal confirmed that these issues could be reproduced outside the project's web authentication layer, though network restrictions might offer some mitigation.
While Agarwal has found no evidence of these vulnerabilities being actively exploited in the wild against healthcare organizations, his testing was conducted on synthetic data in isolated environments. The researcher is coordinating with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) for an upcoming advisory that will include specific CVE identifiers for these flaws.
Fixes for all identified vulnerabilities are not yet complete. In the interim, Agarwal recommends that users restrict access to DICOM and HL7 interfaces and limit administrative REST endpoints to authorized personnel. He also advises users to verify their deployed archive and library builds against the advisories, noting that certain Docker images predate the fix for the multipart vulnerability.
Several commercial PACS and DICOM software vendors integrate with or use DCM4CHE, including MedDream, Mesys, and Comiere. It remains unclear if these downstream vendors have been notified or have assessed the risks posed by these vulnerabilities. Vanderbilt University Medical Center, a documented user of DCM4CHE for research purposes, has also been noted.
The discovery underscores the ongoing security challenges within healthcare IT infrastructure, particularly concerning open-source components that form the backbone of critical systems like medical imaging archives. The potential for data manipulation and service disruption highlights the need for continuous security auditing and prompt patching of widely deployed software.