Summary
MONAI's PydicomReader can accept non-finite values in DICOM spatial metadata and use them to build an affine matrix without validation. If a crafted DICOM is uploaded to an affected deployment and processed, those values may disrupt inference, poison stored data, or produce geometrically incorrect results.
MONAI's PydicomReader can accept non-finite values in DICOM spatial metadata and use them to build an affine matrix without validation. If a crafted DICOM is uploaded to an affected deployment and processed, those values may disrupt inference, poison stored data, or produce geometrically incorrect results.
Affected context
The issue occurs in MONAI's PydicomReader._get_affine() when it composes an affine matrix from DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields without checking that the values are finite. In a MONAILabel deployment that accepts DICOM uploads, the risk arises when an uploaded file is processed by this reader and its metadata is passed through downstream transforms, inference, or output writing.
The issue occurs in MONAI's PydicomReader._get_affine() when it composes an affine matrix from DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields without checking that the values are finite. In a MONAILabel deployment that accepts DICOM uploads, the risk arises when an uploaded file is processed by this reader and its metadata is passed through downstream transforms, inference, or output writing.
Exploit preconditions
- Attack surface: A MONAILabel deployment that accepts and processes DICOM uploads.
- Required access: The described scenario does not require authentication, but the attacker must be able to submit a DICOM file to the deployment.
- Trigger point: The uploaded file is parsed and its spatial metadata is used to construct an affine matrix.
- Why exploitation is possible: Non-finite metadata values are trusted and propagated without validation, allowing them to affect downstream processing.
- Attack surface: A MONAILabel deployment that accepts and processes DICOM uploads.
- Required access: The described scenario does not require authentication, but the attacker must be able to submit a DICOM file to the deployment.
- Trigger point: The uploaded file is parsed and its spatial metadata is used to construct an affine matrix.
- Why exploitation is possible: Non-finite metadata values are trusted and propagated without validation, allowing them to affect downstream processing.
Why this happens
The reader uses values from externally supplied DICOM metadata in a geometric calculation without first validating that they are finite and suitable for that calculation. This is an input validation weakness (CWE-20) that can also lead to incorrect computations (CWE-682): invalid numeric values may propagate through transforms and inference rather than being rejected at the input boundary.
The reader uses values from externally supplied DICOM metadata in a geometric calculation without first validating that they are finite and suitable for that calculation. This is an input validation weakness (CWE-20) that can also lead to incorrect computations (CWE-682): invalid numeric values may propagate through transforms and inference rather than being rejected at the input boundary.
Potential impact
- Inference or image-processing workflows may fail.
- Invalid values may persist in a datastore and affect later processing.
- Outputs could contain geometrically corrupted results.
- Downstream services or users may rely on inaccurate imaging results.
- Inference or image-processing workflows may fail.
- Invalid values may persist in a datastore and affect later processing.
- Outputs could contain geometrically corrupted results.
- Downstream services or users may rely on inaccurate imaging results.
General mitigation guidance
Defensive patterns include validating DICOM metadata at the trust boundary and rejecting non-finite or otherwise invalid values before constructing affine matrices. Apply schema and domain checks to spatial fields, and add validation at downstream processing and output boundaries so invalid values cannot silently propagate. Reduce trust in uploaded files through controlled ingestion, isolate processing workloads, and apply least-privilege access to workers and datastores.
Defensive patterns include validating DICOM metadata at the trust boundary and rejecting non-finite or otherwise invalid values before constructing affine matrices. Apply schema and domain checks to spatial fields, and add validation at downstream processing and output boundaries so invalid values cannot silently propagate. Reduce trust in uploaded files through controlled ingestion, isolate processing workloads, and apply least-privilege access to workers and datastores.
How teams detect issues like this
- Use static analysis and code review to identify external numeric metadata used in calculations without finite-value or domain validation.
- Review parser and transform boundaries for checks on values such as spacing, position, and orientation before matrix construction.
- Add automated tests and runtime policies that detect or reject non-finite values at ingestion and before persistence or output writing.
- Use automated code review tools as a supplementary way to flag unvalidated input flowing into geometric calculations.
- Use static analysis and code review to identify external numeric metadata used in calculations without finite-value or domain validation.
- Review parser and transform boundaries for checks on values such as spacing, position, and orientation before matrix construction.
- Add automated tests and runtime policies that detect or reject non-finite values at ingestion and before persistence or output writing.
- Use automated code review tools as a supplementary way to flag unvalidated input flowing into geometric calculations.
