Santesoft’s Sante PACS Server has been the subject of a coordinated advisory cluster this week after multiple remote‑exploitable flaws were disclosed that affect versions prior to 4.2.3, and at least one authoritative vulnerability bulletin places the combined impact at near‑critical severity under the latest CVSS v4 calculus. The technical mix—path traversal, double‑free / memory corruption, cleartext credential transmission, and stored cross‑site scripting (XSS)—creates a real‑world attack surface that can be abused to write arbitrary files, crash services (DoS), harvest credentials and session cookies, and in chained scenarios enable persistence or broader network pivoting. Vendors and security groups are urging immediate patching and network hardening; however, there are discrepancies between vendor download pages and published advisories that administrators must verify before deploying fixes. (tenable.com) (santesoft.com)
Sante PACS Server is a widely deployed DICOM Picture Archiving and Communication System used by clinics, radiology departments and smaller hospitals for storing and serving medical imaging studies. The server includes an embedded web portal and DICOM service endpoints used by modalities, PACS clients and web viewers. That dual exposure—DICOM protocols on one hand and an HTTP(S) web UI on the other—means findings in either code path can have meaningful operational impact for healthcare providers and their IT/clinical engineering teams. Santesoft is headquartered in Cyprus and distributes Windows builds with both SQLite and optional Postgres variants. (santesoft.com)
Between late February and August 2025 multiple security researchers and vulnerability vendors publicly disclosed vulnerabilities in Sante PACS Server; the disclosures were aggregated by third‑party security advisories (Tenable, MS‑ISAC) and later included in national cybersecurity notifications. The technical issues fall into two broad classes: (1) file and memory handling flaws that permit arbitrary file creation and denial‑of‑service (including a double‑free), and (2) web application defects (XSS and cleartext credential handling) that expose operational credentials and session integrity to network eavesdroppers or session‑hijacking attacks. (tenable.com) (cisecurity.org)
(Readers should treat CVE and CVSS information as evolving while CVE records are enriched. For operational decisions rely on vendor advisories and coordinated national advisories; cross‑check the exact build numbers with Santesoft support before applying patches.)
Source: CISA Santesoft Sante PACS Server | CISA
Background / Overview
Sante PACS Server is a widely deployed DICOM Picture Archiving and Communication System used by clinics, radiology departments and smaller hospitals for storing and serving medical imaging studies. The server includes an embedded web portal and DICOM service endpoints used by modalities, PACS clients and web viewers. That dual exposure—DICOM protocols on one hand and an HTTP(S) web UI on the other—means findings in either code path can have meaningful operational impact for healthcare providers and their IT/clinical engineering teams. Santesoft is headquartered in Cyprus and distributes Windows builds with both SQLite and optional Postgres variants. (santesoft.com)Between late February and August 2025 multiple security researchers and vulnerability vendors publicly disclosed vulnerabilities in Sante PACS Server; the disclosures were aggregated by third‑party security advisories (Tenable, MS‑ISAC) and later included in national cybersecurity notifications. The technical issues fall into two broad classes: (1) file and memory handling flaws that permit arbitrary file creation and denial‑of‑service (including a double‑free), and (2) web application defects (XSS and cleartext credential handling) that expose operational credentials and session integrity to network eavesdroppers or session‑hijacking attacks. (tenable.com) (cisecurity.org)
Executive summary of the technical findings
- A path‑traversal issue in the web portal/DCM parsing allows attackers to create or download files outside the intended directory, enabling arbitrary file write or disclosure. This class is mapped to CWE‑22 and multiple CVEs have been assigned by vendors and CVE authorities.
- A remote memory‑corruption / double‑free triggered by crafted HL7 or URL‑parsing input can crash the server process and cause a denial‑of‑service (no manual restart by default).
- The web portal transmits credentials in cleartext over the network in some flows, exposing usernames and passwords to passive network attackers or anyone able to monitor the relevant segment.
- Stored XSS vulnerabilities exist in both the web portal and parts of the application that render user‑supplied input; these can steal cookies, perform CSRF‑style actions, or redirect users to malicious pages.
- Exploits for many of the related CVEs are trivial to craft for a motivated attacker once protocol specifics are known and network access exists; the Tenable and MS‑ISAC writeups characterize the most severe flaws as remotely exploitable with low complexity. (tenable.com) (cisecurity.org)
Who and what is affected
3.1 Affected products
- Sante PACS Server: versions prior to 4.2.3 (vendor advisory / CISA advisory guidance lists 4.2.3 or later as the remediation target). Administrators should treat any 4.2.x or earlier installs as potentially vulnerable until confirmed patched. (santesoft.com, tenable.com)
3.2 Deployment context and risk surface
- PACS systems are often placed inside hospital DMZs or clinical VLANs that are accessible to imaging devices, vendor support workstations and—occasionally—remote physicians. This mixed connectivity increases the chance that an attacker with foothold in a network segment (phishing, supply‑chain compromise of imaging modality update servers, or remote workstation) could reach the vulnerable service.
- Medical imaging workflows are latency‑sensitive and highly available; any forced restart, prolonged downtime, or data‑loss caused by exploit activity has direct patient‑care impact (delayed reads, canceled procedures). (santesoft.com)
Detailed technical breakdown
4.1 Path traversal and arbitrary file creation (CWE‑22)
- Vulnerability summary: the web portal and DCM parsing routines fail to sanitize or canonicalize certain DCM path fields and HTTP request paths, allowing crafted requests to write files to arbitrary locations or to download sensitive files like configuration and SQLite DB files.
- Impact: arbitrary file creation can be used to drop web shells, plant ransomware stagers, or write scheduled task entries. Arbitrary file download can expose HTTP.db (which can contain user records/hashed passwords) and other sensitive configuration. Tenable and other bulletins show proof‑of‑concept curl commands that exploit the /assets path traversal to download HTTP.db. (tenable.com)
4.2 Double‑free / memory corruption triggered by HL7 or URL parsing (CWE‑415 and related)
- Vulnerability summary: crafted HL7 payloads or malformed HTTP URLs can drive pointer reuse and double‑free conditions in the server’s main thread, crashing the process and rendering the PACS server unavailable until manually restarted.
- Impact: Denial‑of‑Service is the immediate impact, but memory corruption vulnerabilities sometimes become escalators—if an attacker can shape heap metadata they may chain to code execution. The reported advisories list this as high‑severity and exploitable remotely without authentication in certain configurations. (tenable.com)
4.3 Cleartext transmission of credentials (CWE‑319)
- Vulnerability summary: the web portal transmits login credentials or other sensitive information without TLS in some flows or uses an incorrectly implemented encryption wrapper that results in exposure on the wire.
- Impact: Passive sniffing on internal networks (shared VLANs, misconfigured VPNs, remote access tunnels, or compromised network taps) can harvest credentials. In healthcare environments where staff reuse credentials across systems, this increases lateral movement risk dramatically. Advisories recommend ensuring TLS everywhere and validating that the application enforces HTTPS and HSTS. (tenable.com)
4.4 Stored Cross‑Site Scripting (CWE‑79)
- Vulnerability summary: several inputs accepted by the web portal are not properly encoded before being rendered in administrative or clinician web pages, enabling persistent XSS payloads to be stored and executed in another user’s browser.
- Impact: cookie theft, session hijacking, or silent redirection of clinicians to phishing pages; in an EMR/PACS integration scenario XSS could be used to steal tokens used by other integrated applications. Some XSS variants require post‑auth interaction; others can impact non‑privileged users. (tenable.com)
Risk evaluation — what an attacker can achieve
- Immediate operational disruption (DoS) by exploiting the memory corruption/double‑free defects.
- Arbitrary file creation leading to persistence or later remote code execution (by planting malicious DLLs/EXE or altering start‑up scripts).
- Data leakage: downloading HTTP.db or config files can reveal password hashes or tokens used for integrations (RIS/HIS), which enables further lateral movement and patient data exfiltration.
- Session hijacking and account takeover via stored XSS or stolen credentials, enabling an attacker to act as a clinician and request or export studies.
- Supply‑chain or ransomware positioning: PACS servers store large volumes of PHI (Protected Health Information), making them high‑value targets for extortion.
Verification and source reconciliation (what has been confirmed)
- Tenable and MS‑ISAC published technical writeups that document path traversal, stack/heap memory faults and credential handling defects. Tenable’s TRA advisory includes PoC examples for path traversal and recommends upgrading to fixed versions. (tenable.com, cisecurity.org)
- The Santesoft product download pages reflect active versioning for the Sante PACS Server product family; at the time of writing the public download page shows version 4.2.2 as the latest readily available binary. This appears to conflict with advisories that recommend 4.2.3 or 4.2.0 as remediation targets in various vendor notes, so administrators must confirm the correct patch version with Santesoft support and the advisory text before wide deployment. Do not assume a particular download page reflects the security patch referenced in CISA/third‑party advisories without vendor confirmation. (santesoft.com, tenable.com)
- Several of the CVE records are present in national databases (for example, NVD entries for path traversal CVEs appear under CVE identifiers referenced by Tenable). NVD entries and vendor advisories may differ in fields and CVSS scores while they undergo enrichment—this is normal; treat vendor advisories and coordinated disclosure timelines as the authoritative operational guidance. (nvd.nist.gov, tenable.com)
Mitigation & remediation guidance (practical, prioritized steps)
The following steps are prioritized for immediate operational safety and are intended for SOC/IT and clinical engineering teams responsible for PACS:- Immediate remediation (days)
- Confirm the installed Sante PACS Server version on every imaging server (check file version and product build).
- If the vendor or authoritative advisory lists a fixed version (4.2.3 or later), coordinate an emergency maintenance window and install the vendor‑published patch after validating the vendor build‑notes in a staging environment.
- If a vendor patch is not yet available for a particular flaw in your installed version: disable the public web portal (or restrict access to a trusted management subnet) until a patch is applied.
- Network containment & hardening
- Remove direct Internet exposure; place PACS servers behind strict ACLs and firewall rules, only allowing access from known modality IPs and management subnets. Use network microsegmentation where possible.
- If remote access is required, require strong VPN access with MFA and limit the allowed IPs for vendor maintenance sessions.
- Consider blocking inbound HTTP → redirect to HTTPS reverse proxies configured with TLS 1.2+ and strong ciphers; enable HSTS.
- Application hardening & configuration
- Enforce HTTPS and verify certificate chain and HSTS; do not rely on application‑level “optional TLS” settings.
- Rotate and reset administrative credentials after patching. Where possible, use unique, long, and complex passwords or integrate with an enterprise SSO (OIDC/SAML) or LDAP/AD with proper account lifecycle management.
- Enable application logging at verbose level for authentication, DICOM associations, and unusual file operations; forward logs to a centralized SIEM for correlation.
- Detection and monitoring
- Add IDS/IPS or WAF rules to detect the path traversal patterns and abnormal /assets requests documented in advisories; look for unusual requests like "../../../../HTTP.db".
- Monitor for abnormal process restarts, crash dumps, or HL7 feeds that deviate from expected lengths/formats (which may indicate attempted exploitation).
- Search historic logs for evidence of file downloads of HTTP.db, GET /assets/../../ sequences, or long encrypted credential fields that exceed expected lengths.
- Forensic readiness & backup
- Take verified backups of PACS databases and file stores before applying updates; maintain immutable backups where possible.
- If compromise is suspected: preserve logs and disk images, capture memory if feasible, and follow incident response / legal reporting policies.
- Compensating controls
- Tighten database file permissions so that even if an attacker can request a download, the web server process cannot expose files outside its data directory.
- Apply endpoint protections and application control to management workstations to reduce the likelihood of credential theft.
Detection signatures & incident response playbook (concise steps)
- Immediate detection indicators:
- HTTP requests containing “../” sequences or long URL paths referencing .HTTP/HTTP.db or /assets/../../.
- Unexpected process crashes in the PACS server, core dumps, or “double free” style crash signatures.
- Unusually long encrypted form fields submitted to the /login endpoint.
- Web logs with script tags or suspicious payloads being posted to clinician notes pages (stored XSS attempts).
- Incident response actions:
- Isolate the server at the network layer (block outside access).
- Take forensic snapshots (disk and memory).
- Check for planted files in webroot, scheduled task entries, or recently created files outside expected directories.
- Rotate keys/passwords for accounts potentially exposed; force password resets for web portal users.
- Engage vendor support and, if relevant, health‑sector incident response partners or national cyber authorities.
- Notify privacy/compliance teams—PHI exposure may invoke notification obligations under HIPAA or local regulations.
Operational and regulatory implications for healthcare providers
- Patient care impact: imaging backlog and procedural delays are immediate risks if PACS becomes unavailable.
- Privacy and compliance: downloading configuration or DB files that contain user records or identifiers may trigger HIPAA breach workflows in the U.S. and similar privacy rules elsewhere.
- Third‑party and vendor relationships: coordinate with Santesoft and modality vendors; a coordinated disclosure and patching process will minimize downtime and mitigate liability.
Vendor response and timeline discrepancies — what to watch for
- Advisory aggregators (Tenable, MS‑ISAC) and national bodies (CISA) have published guidance and timelines. Tenable published a technical advisory in March 2025 describing serious path traversal and stack issues for version 4.1.0 and recommended updates; MS‑ISAC and others mirrored that urgency. (tenable.com, cisecurity.org)
- The Santesoft public download pages visible at the time of review list version 4.2.2 (May 26, 2025) as the current downloadable build; some advisories (and the coordinated messages) reference 4.2.3 as the patched release. Before sweeping upgrades, validate the vendor’s official security bulletin or contact Santesoft support directly to confirm the precise build that mitigates each CVE. Do not assume the listed download is the fix referenced by the advisory without vendor confirmation. (santesoft.com)
Strengths and notable positives in the coordinated response
- Multiple security vendors and CERT/ISACs coordinated their disclosures and provided PoC and remediation timelines—this reduces ambiguity for administrators and helps SOC teams prioritize. Tenable’s advisory contains concrete PoCs and remediation steps that can be implemented operationally. (tenable.com)
- The vendor appears to be issuing version updates on a regular cadence; perpetual license models and update availability simplify patch distribution for many deployed customers—provided the correct security builds are released and communicated. (santesoft.com)
Main weaknesses and remaining risk
- Persistent mismatch or lag between advisory text and public download pages introduces uncertainty for administrators and can delay remediation.
- PACS servers frequently run in clinical networks that are difficult to patch quickly (operational constraints, vendor certification requirements). This increases the risk window.
- Some CVE entries and CVSS v4 scores are still being enriched in national databases; relying only on those feeds can under‑prioritize urgent work. Use vendor advisories and coordinated CSIRT/ISAC bulletins as the operational authority when they conflict with incomplete NVD records. (nvd.nist.gov, tenable.com)
Action checklist (what to do in the next 72 hours)
- Inventory: confirm PACS server versions and network exposure for every Sante PACS instance.
- Block: restrict access to management and web UI ports to trusted IP ranges and VPNs.
- Patch: contact Santesoft support, obtain assurance about the exact remediation build (4.2.3 or other) and schedule staged deployment after testing.
- Monitor: deploy IDS/WAF rules for path‑traversal and long‑input login attempts and forward logs to SIEM.
- Backup: take verified backups of PACS files and databases before patching.
- Communicate: notify clinical leadership and vendors of expected maintenance windows and contingency workflows for imaging continuity.
Conclusion
The Sante PACS Server disclosures underline a recurring reality in healthcare IT: legacy or feature‑rich imaging platforms that expose both DICOM services and web portals create a broad attack surface. The vulnerabilities disclosed combine easy‑to‑exploit web application flaws with lower‑level memory corruption risks—an appetite for chained attacks that can escalate from information disclosure to denial‑of‑service and persistence. Administrators must prioritize immediate containment (network restrictions, disable public interfaces) and validate vendor patches before rolling them out; forensic readiness and close coordination with Santesoft, vendor partners and relevant national cybersecurity authorities will be critical for minimizing both clinical disruption and privacy risk. Technical teams should treat this event as a high‑urgency patching and network‑segmentation exercise and verify remediation against the vendor’s security bulletin before declaring systems secure. (tenable.com, santesoft.com, cisecurity.org)(Readers should treat CVE and CVSS information as evolving while CVE records are enriched. For operational decisions rely on vendor advisories and coordinated national advisories; cross‑check the exact build numbers with Santesoft support before applying patches.)
Source: CISA Santesoft Sante PACS Server | CISA
