Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability

The impact of CVE-2024-1863 is severe. Successful exploitation allows an attacker to inject malicious SQL code, which is then executed by the Sante PACS Server with NETWORK SERVICE privileges. This can lead to unauthorized access to sensitive patient data, modification of medical records, and even complete control over the server. Given the lack of authentication required, the attack surface is broad, and exploitation is relatively straightforward. The potential for data breaches and disruption of healthcare services is significant. This vulnerability shares characteristics with other SQL injection flaws where attackers can bypass authentication and gain elevated privileges.

Healthcare organizations utilizing Sante PACS Server, particularly those with older versions (3.3.3–3.3.3), are at significant risk. Shared hosting environments where multiple PACS servers reside on the same infrastructure are also vulnerable, as a compromise of one server could potentially impact others. Systems with weak network segmentation are especially susceptible.

• windows / server: Monitor PowerShell for suspicious commands related to database access or SQL injection attempts. Use Windows Defender to scan for malicious scripts targeting the Sante PACS Server installation directory. • linux / server: Examine system logs (journalctl) for unusual database connection attempts or SQL errors. Use auditd to monitor access to the token endpoint (port 3000). • generic web: Use curl to test the token endpoint with various SQL injection payloads. Analyze access and error logs for suspicious requests.

curl -X POST -d 'token='; DROP TABLE users; -- http://<sante_pacs_server_ip>:3000/token

1. 2024-04-01Disclosure

   disclosure

1. Gereserveerd2024-02-23
2. Gepubliceerd2024-04-01
3. Gewijzigd2024-08-08
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-1863 is to upgrade Sante PACS Server to a patched version as soon as possible. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting network access to the token endpoint (port 3000) to trusted sources only. Web Application Firewalls (WAFs) can be configured to detect and block SQL injection attempts targeting the token parameter. Thoroughly review and validate all user inputs within the application to prevent future injection vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection attack on the token endpoint and verifying that it is properly sanitized.