GHSA-6hp3-vr39-rqw8: Input Validation
Summary
An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.
No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).
Severity: CVSS 3.1: 8.7 HIGH CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L CWE: CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation)
Details
Root Cause — Layer 1: pydicom accepts invalid VR values
pydicom's DSfloat.new() calls Python's float(val), which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The isvalidds() check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value.
python >> from pydicom.valuerep import DSfloat >> DSfloat("NaN") nan # Accepted silently — should be rejected >> DSfloat("inf") inf # Accepted silently — should be rejected
This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current).
A related bypass exists in pydicom's IS type: IS("1e4") returns 10000 via an int(float(val)) fallback, accepting scientific notation that is not valid per the DICOM standard.
Root Cause — Layer 2: MONAI Core trusts pydicom output without validation
MONAI's PydicomReader.getaffine() builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO isfinite() or isnan() checks. NaN in PixelSpacing produces NaN in the affine diagonal, propagating through every spatial transform: PydicomReader.getaffine() → LoadImaged → Spacingd → Model → Writer
Root Cause — Layer 3: MONAILabel REST API accepts anything
MONAILabel's PUT /datastore/ endpoint accepts DICOM uploads with no authentication (default deployment), no validation of spatial metadata, and no bounds checking on any DICOM tag values. The malicious DICOM is stored permanently and made available for inference.
PoC
Environment Setup: bash Start MONAILabel (Docker) docker pull projectmonai/monailabel:latest docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \ projectmonai/monailabel:latest monailabel startserver \ --app /opt/monai/sample-apps/radiology \ --studies /opt/monai/datasets/Task09Spleen/imagesTr \ --conf models segmentation
Verify server is running curl http://localhost:8000/info/
Step 1 — Establish baseline (legitimate data works): bash curl -X POST "http://localhost:8000/infer/segmentation?image=spleen40" \ -o baseline.nii.gz -w "HTTP %{httpcode} - %{sizedownload} bytes" Result: HTTP 200, ~223,628 bytes valid segmentation mask
Step 2 — Run the attack (NaN DICOM upload + inference): bash pip install pydicom numpy requests python pocmonailabeldsbypass.py --server http://localhost:8000
The PoC script: 1. Confirms pydicom accepts NaN/inf in DS fields 2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient 3. 3. Uploads each via PUT /datastore/ (no auth required) — HTTP 200 accepted 4. 4. Triggers inference via POST /infer/segmentation — HTTP 500, server crash Demonstrated Results:
| Payload | Upload | Inference | Result | |---|---|---|---| | Baseline (spleen40) | N/A | HTTP 200 | Valid 223 KB segmentation | | NaN PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (18.0s wasted compute) | | NaN PixelSpacing + IPP | HTTP 200 | HTTP 500 | RuntimeError crash (16.7s wasted compute) | | Inf PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (16.4s wasted compute) |
Server crash traceback: monailabel/tasks/infer/basicinfer.py → self.writer(data) monailabel/transform/writer.py → writeitk(...) itk/ITKCommonBasePython.py → itkProcessObjectUpdate() RuntimeError: itkGDCMImageIO.cxx:1226: ITK ERROR: GDCMImageIO: A Floating point buffer was passed but the stored pixel type was not specified.
Each request burns ~16 seconds of server compute (full ML inference pipeline) before crashing. The NaN DICOM persists in the datastore — any future inference on that image ID crashes the server again.
Library-level confirmation: 17/17 test vectors confirmed against MONAI 1.5.2 and pydicom 3.0.2, including actual MONAI LoadImaged and Spacingd transforms accepting NaN geometry without error.
Impact
1. Denial of Service: A single ~132 KB DICOM upload crashes the MONAILabel inference pipeline. All active inference requests from legitimate users are aborted. Repeatable indefinitely with minimal bandwidth. 2. Silent Data Corruption: NaN values in spatial metadata propagate through the entire ML inference pipeline and produce geometrically incorrect segmentation masks. If the output writer does not crash, the result is returned with HTTP 200 and zero warnings. 3. Persistent Datastore Poisoning: The malicious DICOM is stored permanently via PUT /datastore/. Any future inference request on that image ID reproduces the crash or corruption, persisting across server restarts. Affected MONAI Ecosystem (9 repositories): - MONAI Core: PydicomReader, LoadImaged, Spacingd transforms - - MONAILabel: REST API + DICOMweb datastore - - MONAI Deploy App SDK: DICOMDataLoaderOperator - - model-zoo, VISTA, GenerativeModels, tutorials, research-contributions Affected DICOM Tags (any DS VR): PixelSpacing, ImagePositionPatient, SliceThickness, ImageOrientationPatient, RescaleSlope, WindowCenter/WindowWidth
Recommended Fix: 1. Add math.isfinite() validation in PydicomReader.getaffine() on all values from PixelSpacing, IPP, IOP. Raise ValueError for NaN/inf. 2. 2. Validate spatial metadata of uploaded DICOM in MONAILabel PUT /datastore/. Return HTTP 400 for invalid geometry. 3. 3. Validate spatial metadata is finite in LoadImaged/Spacingd before resampling. 4. 4. Coordinate with pydicom upstream to reject NaN/inf in DS fields in all validation modes. Upstream: pydicom GHSA filed 2026-04-05.
Author: Paulino Calderon (paulino@calderonpale.com)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/monaito a version that resolves this vulnerability.Fixed in 1.6.1 - Configuration
Configure pydicom validation to use RAISE rather than the default WARN mode so invalid DS values such as NaN and inf are rejected.
pydicom validation mode = RAISE - Compensating control
Add math.isfinite() validation for all PixelSpacing, ImagePositionPatient, and ImageOrientationPatient values in MONAI's PydicomReader._get_affine(), LoadImaged, and Spacingd; validate the same spatial metadata on MONAILabel PUT /datastore/ uploads and reject invalid geometry with HTTP 400.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
MONAILabel servers whose REST API is reachable over the network are exposed because the default API does not require authentication. An attacker needs network access to the server, which uses port 8000 by default.
What must an attacker do to trigger the issue?
The attacker can upload a single crafted DICOM file of approximately 132 KB through the REST API. No credentials or user interaction are required.
What impact should operators expect?
A crafted file can crash a running MONAILabel server or silently corrupt medical AI inference results. The invalid DICOM Decimal String or Integer String values can propagate through the spatial-transform and ML inference pipeline.
What can be done when an immediate update is not possible?
Restrict network access to the MONAILabel REST API so untrusted parties cannot upload DICOM files. This is particularly important for the default unauthenticated API configuration.