CVE-2023-33466

What it actually does

Authenticated API users can supply crafted paths that traverse the filesystem and overwrite arbitrary files, including Orthanc configuration files in certain deployments, enabling subsequent remote code execution.

Why it matters to the business

Attackers with limited API access can achieve full system takeover, disrupt medical imaging workflows, exfiltrate patient data, or persist on servers handling sensitive healthcare records; the issue is long-public with low but steady exploitation probability.

How an attack unfolds

An attacker who obtains valid API credentials sends specially constructed requests that abuse path traversal to replace configuration or executable files; when the server restarts or reloads the overwritten files, arbitrary commands execute under the Orthanc process privileges.

How to fix it

Upgrade Orthanc to version 1.12.0 or later. Restrict API access to trusted sources, enforce least-privilege file permissions on the Orthanc data directory, and monitor for unexpected file modifications in configuration paths.

How to confirm the fix worked

Confirm the running Orthanc version is 1.12.0 or newer; review server configuration to ensure API authentication and path restrictions are active; test by attempting a controlled traversal request from an authenticated account and verifying the request is rejected.

Typical attack path

1. Obtain valid Orthanc API credentials
2. Identify writable paths via API endpoints handling file or configuration operations
3. Craft requests containing directory traversal sequences to target desired files
4. Overwrite configuration or plugin binaries
5. Trigger service restart or configuration reload to execute attacker-controlled code

How to detect it

Search Orthanc API access logs for requests containing sequences such as ../ or unusual file paths; inspect file timestamps on configuration and executable directories for unexpected modifications after 2023-06-29; review process creation events for Orthanc launching unexpected child processes.

What your security team should do

• Immediately upgrade all Orthanc instances to 1.12.0 or newer
• Audit API access logs for suspicious path patterns since publication date
• Apply network segmentation and strict firewall rules around Orthanc deployments
• Implement file integrity monitoring on configuration and plugin directories