Summary
A missing authorization check in the storage status-change REST service may allow a location associated with an existing DICOM instance to be moved into a deletion-related state. When the location reaches TO_DELETE, the purge scheduler may remove the referenced object from storage while the corresponding instance record remains in the database.
A missing authorization check in the storage status-change REST service may allow a location associated with an existing DICOM instance to be moved into a deletion-related state. When the location reaches TO_DELETE, the purge scheduler may remove the referenced object from storage while the corresponding instance record remains in the database.
Affected context
The issue occurs in deployments that expose the storage status-change REST service and use PurgeStorageScheduler to process locations marked for deletion. Risk is higher when callers who should not control storage lifecycle states can submit or influence status changes for locations still referenced by DICOM instance records.
The issue occurs in deployments that expose the storage status-change REST service and use PurgeStorageScheduler to process locations marked for deletion. Risk is higher when callers who should not control storage lifecycle states can submit or influence status changes for locations still referenced by DICOM instance records.
Exploit preconditions
- Attack surface: Storage status-change REST service
- Required access: Ability to reach the service and submit or influence location state changes; the exact authentication requirement depends on deployment configuration
- Trigger point: Processing of a location changed to a deletion-related state, particularly
TO_DELETE - Why exploitation is possible: Authorization is not sufficiently enforced before a state transition that can cause the purge scheduler to delete referenced storage objects
- Attack surface: Storage status-change REST service
- Required access: Ability to reach the service and submit or influence location state changes; the exact authentication requirement depends on deployment configuration
- Trigger point: Processing of a location changed to a deletion-related state, particularly
TO_DELETE - Why exploitation is possible: Authorization is not sufficiently enforced before a state transition that can cause the purge scheduler to delete referenced storage objects
Why this happens
The underlying flaw is an authorization control failure. The service permits a security-sensitive storage state transition without adequately verifying whether the caller is allowed to modify the targeted location or whether the transition is safe for records still associated with DICOM instances. This maps to CWE-862: Missing Authorization, where access to a protected operation is not properly restricted.
The underlying flaw is an authorization control failure. The service permits a security-sensitive storage state transition without adequately verifying whether the caller is allowed to modify the targeted location or whether the transition is safe for records still associated with DICOM instances. This maps to CWE-862: Missing Authorization, where access to a protected operation is not properly restricted.
Potential impact
- Unauthorized deletion of DICOM objects from storage
- Loss of availability for referenced clinical or operational data
- Divergence between database metadata and stored objects
- Data integrity and retention-policy violations
- Possible disruption of downstream workflows that rely on the missing objects
- Unauthorized deletion of DICOM objects from storage
- Loss of availability for referenced clinical or operational data
- Divergence between database metadata and stored objects
- Data integrity and retention-policy violations
- Possible disruption of downstream workflows that rely on the missing objects
General mitigation guidance
Mitigation generally focuses on enforcing authorization and lifecycle consistency at every state-changing boundary.
Common defensive patterns include:
- Require explicit authorization for storage-location state transitions
- Verify that the caller may modify the targeted location and associated instance
- Reject deletion-related transitions when active DICOM references remain
- Use server-side state machines with narrowly permitted transitions
- Apply transactional checks so database references and storage deletion decisions remain consistent
- Run purge operations with the minimum permissions needed for their function
- Prefer fail-closed behavior when authorization or reference checks cannot be completed
Mitigation generally focuses on enforcing authorization and lifecycle consistency at every state-changing boundary.
Common defensive patterns include:
- Require explicit authorization for storage-location state transitions
- Verify that the caller may modify the targeted location and associated instance
- Reject deletion-related transitions when active DICOM references remain
- Use server-side state machines with narrowly permitted transitions
- Apply transactional checks so database references and storage deletion decisions remain consistent
- Run purge operations with the minimum permissions needed for their function
- Prefer fail-closed behavior when authorization or reference checks cannot be completed
How teams detect issues like this
Organizations can look for:
- Static and dynamic analysis rules covering REST endpoints that mutate deletion or retention state
- Code-review signals such as missing ownership checks, role checks, or policy enforcement before state changes
- Tests that attempt unauthorized transitions and verify that referenced objects remain protected
- Audit-log monitoring for unexpected changes to
TO_DELETEor related states - Reconciliation jobs that identify database records whose referenced storage objects are missing
- Policy enforcement requiring authorization and referential-integrity checks for destructive operations
Organizations can look for:
- Static and dynamic analysis rules covering REST endpoints that mutate deletion or retention state
- Code-review signals such as missing ownership checks, role checks, or policy enforcement before state changes
- Tests that attempt unauthorized transitions and verify that referenced objects remain protected
- Audit-log monitoring for unexpected changes to
TO_DELETEor related states - Reconciliation jobs that identify database records whose referenced storage objects are missing
- Policy enforcement requiring authorization and referential-integrity checks for destructive operations
