OHIF Viewers DOM-based XSS via malicious encapsulated PDF object
Opening a malicious file in a medical image viewer can leak your login details.
Summary
A malicious medical imaging object opened in the dicom-pdf extension of OHIF Viewers can run web script that reaches session storage, authentication tokens and same-origin PACS requests. Versions from 3.5.0-beta.0 until 3.12.15, 3.13.7 and 3.14.0-beta.19 are affected.
Affected when
- dicom-pdf extension in use
- Encapsulated PDF object opened
What to do
Update to 3.12.15, 3.13.7 or 3.14.0-beta.19 or later. Check that your version is newer than the affected range and read the vendor's advisory.
Update to at least the version for your product:
- OHIF Viewers 3.12 3.12.15 or later
- OHIF Viewers 3.13 3.13.7 or later
- OHIF Viewers 3.14 3.14.0-beta.19 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen