Summary

On June 25, 2026, CISA issued an advisory (ICSMA-26-176-02) about a critical vulnerability in the OHIF DICOM Web Viewer Framework. This flaw, identified as CVE-2026-12473, has a CVSS score of 8.3 and is rated HIGH severity. The vulnerability stems from two data sources-DICOMWebProxy and DICOMJSON-that fetch arbitrary URL parameters without validation. In the default configuration, an authentication service injects the authenticated user's OIDC Bearer token into requests sent to these data sources. This allows attackers to craft links that can steal tokens if users are tricked into clicking them.

What Happened

The vulnerability lies in how OHIF handles certain URL parameters within its DICOM Web Viewer Framework. Specifically, two components-DICOMWebProxy and DICOMJSON-are configured by default to fetch data from arbitrary URLs without proper validation. This oversight can be exploited by attackers who craft malicious links that include these parameters.

When a user clicks on such a link, the global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the request sent to the attacker-controlled server. This effectively hands over the user's session credentials to an unauthorized party. Although DICOMweb data sources themselves are not impacted by this flaw, the potential for credential theft remains significant.

Technical Details

The technical crux of CVE-2026-12473 is its ability to exploit the lack of input validation in two specific OHIF components:

1. DICOMWebProxy: This component acts as an intermediary between clients and DICOMweb servers.
2. DICOMJSON: This component handles JSON-formatted requests for DICOM data.

Both components, by default, accept URL parameters without validating their source or content. The authentication service in OHIF exacerbates the issue by automatically including the user's OIDC Bearer token in these requests. This means that any crafted link containing malicious parameters can lead to unauthorized access if clicked by an authenticated user.

Affected Products and Fixed Versions

The vulnerability affects the default configuration of the OHIF DICOM Web Viewer Framework, which is widely used in healthcare environments for viewing medical images. As of now, no specific fixed versions have been released, making it crucial for users to apply defensive measures immediately.

Exploitation Status

As per CISA's advisory, there has been no known public exploitation specifically targeting this vulnerability at the time of reporting. However, the potential risk remains high due to the nature of the flaw and its impact on user authentication tokens.

Indicators of Compromise

Indicators include unexpected requests containing OIDC Bearer tokens being sent to unauthorized servers. Monitoring for such anomalies can help in early detection of exploitation attempts.

Detection Opportunities

Organizations can implement monitoring solutions that track outbound requests for unusual patterns, especially those involving sensitive data like authentication tokens. Additionally, network traffic analysis tools can be configured to alert on suspicious activities related to the affected components.

Why This Matters for Defenders

For defenders, understanding this vulnerability is crucial due to its potential impact on healthcare systems' security. The ability of attackers to steal authentication tokens could lead to unauthorized access to sensitive medical data and systems. Immediate defensive measures are necessary to mitigate risks until a patch becomes available.

Defender Guidance

1. Network Segmentation: Isolate the OHIF framework from other critical systems to limit potential exposure.
2. Monitoring and Alerts: Set up alerts for unusual outbound requests containing authentication tokens.
3. User Training: Educate users about phishing attacks and the risks of clicking on unsolicited links.
4. Access Controls: Implement strict access controls and review permissions regularly.

What Remains Unclear

While the advisory provides a clear description of the vulnerability, specific details about affected versions or patches are not yet available. Organizations should stay updated with further advisories from CISA for any updates on fixed versions.

Hashtags

#h4rithd #news #HarithDilshan #OHIF #DICOM #CVE202612473 #HealthcareSecurity