CVE-2026-12473: OHIF Viewers SSRF Vulnerability — Detection and Remediation Guide

---
title: Potential SSRF via OHIF Node.js Process Outbound Connection
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects potential SSRF exploitation in OHIF Viewers by identifying the Node.js parent process making outbound connections to private or non-standard IP ranges, indicative of internal service scanning or data exfiltration.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-02
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.006
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    DestinationPort:
      - 80
      - 443
      - 8080
  filter_public:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection and filter_public
falsepositives:
  - Legitimate retrieval of DICOM images from internal PACS nodes (verify against allowlist)
level: high
---
title: OHIF Web Access Anomaly - URL Parameter in Query String
id: 9b2c3d4e-5f6a-7890-1234-56789abcdef0
status: experimental
description: Detects attempts to exploit OHIF by looking for suspicious 'url' parameters containing 'http' in access logs, which may indicate an attempt to trigger the DICOMWebProxy or DICOMJSON SSRF.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-02
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1071.001
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri|contains: 'url=http'
  condition: selection
falsepositives:
  - Unlikely, unless application legitimately passes full URLs as query strings
level: medium

// Hunt for Node.js processes (OHIF) making outbound connections to suspicious IPs
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "node.exe"
| where ActionType == "ConnectionSuccess"
| extend IsPrivate = iff(
    ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or
    ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or
    ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or
    ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or
    RemoteIP == "169.254.169.254", true, false)
| where IsPrivate == true or RemoteUrl contains "metadata"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

-- Hunt for Node.js processes with established network connections to private ranges
SELECT Pid, Name, Cmdline, Family, RemoteAddress, RemotePort, State
FROM netstat()
WHERE Name =~ "node"
  AND State =~ "ESTABLISHED"
  AND (
    RemoteAddress =~ "^10\." 
    OR RemoteAddress =~ "^192\.168\." 
    OR RemoteAddress =~ "^172\.(1[6-9]|2[0-9]|3[0-1])\."
    OR RemoteAddress =~ "^127\."
  )

#!/bin/bash
# Remediation script to check OHIF Viewer version for CVE-2026-12473
# Requires: access to the deployment directory and package.

OHIF_DIR="/var/www/ohif-viewer" # Adjust path as needed
REQUIRED_VERSION="3.13.0" # Assumed patched version placeholder, check vendor advisory
VULNERABLE_MAX="3.12.0"

echo "Checking OHIF Viewer installation at $OHIF_DIR..."

if [ -f "$OHIF_DIR/package." ]; then
    CURRENT_VERSION=$(grep '"version"' "$OHIF_DIR/package." | head -n 1 | awk -F: '{print $2}' | tr -d '" ,' | tr -d '\r')
    
    echo "Detected Version: $CURRENT_VERSION"
    
    # Compare versions (simple string comparison for this example)
    if [ "$(printf '%s\n' "$VULNERABLE_MAX" "$CURRENT_VERSION" | sort -V | head -n1)" = "$CURRENT_VERSION" ] && [ "$CURRENT_VERSION" != "$VULNERABLE_MAX" ]; then
        echo "[INFO] Version seems older than or equal to vulnerable range, or check logic manually."
    fi

    # Logic: if current version is less than or equal to vulnerable max
    # Note: 'sort -V' handles semantic versions correctly
    HIGHEST_VERSION=$(printf '%s\n' "$CURRENT_VERSION" "$VULNERABLE_MAX" | sort -V | tail -n 1)

    if [ "$HIGHEST_VERSION" = "$VULNERABLE_MAX" ]; then
         echo "[ALERT] Vulnerable version detected ($CURRENT_VERSION <= $VULNERABLE_MAX)."
         echo "Action Required: Update OHIF Viewers immediately per CISA Advisory ICSMA-26-176-02."
         exit 1
    else
         echo "[OK] Version $CURRENT_VERSION appears to be patched."
         exit 0
    fi
else
    echo "[ERROR] package. not found at $OHIF_DIR. Please verify the installation path."
    exit 1
fi