CVE-2024-27629

What it actually does

Local command injection in dcm2niix allows unsanitized generated filenames to be passed directly into a system call when specific compression options are used, resulting in arbitrary command execution with the privileges of the invoking user.

Why it matters to the business

An attacker with local access can run arbitrary code on systems that process medical imaging files with the affected tool, leading to potential compromise of workstations or servers used for neuroimaging workflows and possible data theft or further lateral movement.

How an attack unfolds

An attacker crafts a specially named input file or directory whose generated output filename contains shell metacharacters. When dcm2niix is invoked with a compression flag that triggers a system() call, the filename is interpolated without escaping, causing the attacker-supplied commands to execute.

How to fix it

Upgrade rordenlab/dcm2niix to commit e2ead4b3c3b6d9763ca17638c10e3b407bf3f21d or later; rebuild and redeploy any containers or packages that embed the vulnerable binary.

How to confirm the fix worked

Confirm the installed binary reports a build containing commit e2ead4b3c3b6d9763ca17638c10e3b407bf3f21d; test with a filename containing shell metacharacters and a compression flag to verify no command injection occurs.

Typical attack path

1. Place a maliciously named file or directory in a location processed by dcm2niix
2. Invoke dcm2niix with a compression option that uses an internal system call
3. Trigger filename generation that concatenates the attacker-controlled string into the shell command
4. Execute arbitrary commands under the privileges of the dcm2niix process

How to detect it

Review process execution logs and command-line history on systems running dcm2niix for invocations that include compression flags together with unusual filenames containing shell metacharacters; inspect audit logs for unexpected child processes spawned by dcm2niix.

What your security team should do

• Immediately update all instances of dcm2niix to the fixed commit
• Restrict use of compression flags on untrusted input until patched
• Audit systems that run dcm2niix for unexpected processes or file modifications
• Add dcm2niix to the organization's software inventory and vulnerability scanning policy