OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

Summary

An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands.

Attacker model: Any actor who can get a DICOM object in front of a victim — email a .dcm for local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source. Preconditions: Victim opens a study whose SOP Class is Encapsulated PDF (1.2.840.10008.5.1.4.1.1.104.1) and OHIF's dicom-pdf extension renders it (default in the standard modes).

Taint path

Source — two attacker-controlled tags on the encapsulated-document instance:

• MIMETypeOfEncapsulatedDocument (0042,0012)
• EncapsulatedDocument (0042,0011) — the raw document bytes

extensions/dicom-pdf/src/getSopClassHandlerModule.js:15,20 reads the MIME tag with no validation and passes it as defaultType:

const { SeriesDescription = 'PDF', MIMETypeOfEncapsulatedDocument } = instance;
...
const renderedUrlParams = {
  instance,
  tag: 'EncapsulatedDocument',
  defaultType: MIMETypeOfEncapsulatedDocument || 'application/pdf',  // attacker-controlled
  singlepart: 'pdf',
};
const renderedUrl = dataSource.retrieve.directURL(renderedUrlParams);

Sink — defaultType becomes the Blob type in all three retrieval paths:

Local file (no server required): extensions/default/src/DicomLocalDataSource/index.js:120-131

directURL: params => {
  const { instance, tag, defaultType } = params;
  const value = instance[tag];
  if (value instanceof Array && value[0] instanceof ArrayBuffer) {
    return URL.createObjectURL(new Blob([value[0]], { type: defaultType }));  // attacker MIME
  }
},

DICOMweb InlineBinary: extensions/default/src/utils/getDirectURL.ts:40-44 → platform/core/src/utils/b64toBlob.js:18

if (value.InlineBinary) {
  const blob = utils.b64toBlob(value.InlineBinary, defaultType);   // -> new Blob(..., { type: defaultType })
  value.DirectRetrieveURL = URL.createObjectURL(blob);
  return value.DirectRetrieveURL;
}

DICOMweb bulk data: extensions/default/src/utils/getDirectURL.ts:52-55

return value.retrieveBulkData(options).then(arr => {
  value.DirectRetrieveURL = URL.createObjectURL(new Blob([arr], { type: defaultType }));
  return value.DirectRetrieveURL;
});

Render — extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx:86-92

<object
  data={url}                 {/* blob: URL whose stored MIME = attacker's MIMETypeOfEncapsulatedDocument */}
  type="application/pdf"     {/* only a hint; overridden by the blob's own Content-Type */}
  className={style}
>

Why it fires. A blob: URL stores the MIME type passed at new Blob(..., { type }) construction. When such a URL is navigated/embedded, the browser uses the blob's stored Content-Type to choose a handler; the <object type="application/pdf"> attribute is a pre-load hint, not an override. A blob created with type: 'text/html' therefore renders as an HTML document, and because blob: URLs inherit the creating page's origin, any <script> in it executes in the OHIF origin — with access to localStorage/sessionStorage, auth tokens, and same-origin requests to the PACS.

Impact

Users using the applications. If the application is behind authentication then session can be stolen. If on the same DNS name some other applications are hosted, they are also impacted.

Patches

Fixed in @ohif/extension-dicom-pdf 3.12.18, 3.13.10 and 3.14.0-beta.36 (fix: https://github.com/OHIF/Viewers/pull/6228). If you build OHIF from source, the fix first landed in tags 3.12.15, 3.13.7 and 3.14.0-beta.19. Versions 3.5 to 3.11 will not receive a fix. Upgrade to a patched 3.12, 3.13 or 3.14 version.