Unauthenticated Remote Code Execution in the DICOM Receiver

mercure is an open-source DICOM routing and processing platform for medical imaging workflows. We appreciate the maintainers' work on it and their prompt, constructive response to this report.

The getdcmtags binary is part of the DICOM receiver pipeline. After storescp writes an incoming DICOM file, getdcmtags extracts tag values and registers the file with the bookkeeper service. It builds that registration call as a shell command through string concatenation and runs it with system().

Two tag values, SOPInstanceUID and SeriesInstanceUID, are read with DCMTK's findAndGetOFStringArray(), which returns the raw bytes without enforcing the DICOM UID format (digits and dots only). They are concatenated directly into the command string:

void sendBookkeeperPost(OFString filename, OFString fileUID, OFString seriesUID)
{
    if (bookkeeperAddress.empty())
    {
        return;
    }

    std::string cmd = "wget -q -T 1 -t 3 --post-data=\"filename=";
    cmd.append(filename.c_str());     // contains SeriesInstanceUID
    cmd.append("&file_uid=");
    cmd.append(fileUID.c_str());      // SOPInstanceUID, attacker-controlled
    cmd.append("&series_uid=");
    cmd.append(seriesUID.c_str());    // SeriesInstanceUID
    cmd.append("\"");
    cmd.append(" --header=\"Authorization: Token ");
    cmd.append(bookkeeperToken);
    cmd.append("\" http://");
    cmd.append(bookkeeperAddress);
    cmd.append("/register-dicom -O /dev/null");

    system(cmd.data());               // command injection
}

Before concatenation, readTag() applies a small character substitution that is insufficient and, in one case, harmful: a carriage return is rewritten to ;, which introduces a shell command separator. Dollar signs, parentheses, backticks, and pipes pass through untouched. Because the values sit inside double quotes in the command, $(...) command substitution is still evaluated by the shell:

OFCondition result = dataset->findAndGetOFStringArray(tag, out);
// ...
for (size_t i = 0; i < out.length(); i++)
{
    switch (out[i])
    {
    case 13:            // CR -> semicolon
        out[i] = ';';
        break;
    case 10:            // LF -> space
        out[i] = ' ';
        break;
    case 34:            // double quote -> single quote
        out[i] = 39;
        break;
    default:
        break;
    }
}

The receiver runs storescp with --promiscuous, so it accepts associations from any calling AE title without authentication. A single DICOM C-STORE to port 11112 carrying a crafted SOPInstanceUID is enough: getdcmtags reads the value, passes it to sendBookkeeperPost(), and system() evaluates the embedded command during argument expansion. The bookkeeper does not need to be reachable; the injected command runs before wget fails.

The injection targets SOPInstanceUID specifically. SeriesInstanceUID is also attacker-controlled, but it is used earlier for directory creation and file renaming; shell metacharacters there make those file operations fail and getdcmtags exits before reaching the vulnerable call. SOPInstanceUID is consumed only by sendBookkeeperPost().

Command execution as the mercure user (uid 1000) is confirmed by the output of an injected id command:

uid=1000(mercure) gid=1000(mercure) groups=1000(mercure)