monai is an AI Toolkit for Healthcare Imaging

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via PydicomReader._get_affine in monai/data/image_reader.py, which builds an affine matrix from DICOM tags PixelSpacing, ImagePositionPatient, and ImageOrientationPatient without validating that the values are finite. An attacker can upload a DICOM file carrying NaN or inf in those DS tags, causing the corrupted affine matrix to propagate through spatial transforms and either crash the inference server or silently corrupt results. Because the malicious DICOM persists in the datastore, any subsequent inference request against that image ID also crashes the server, enabling repeated denial of service with each request consuming significant compute time.

Environment Setup:

# Start MONAILabel (Docker)
docker pull projectmonai/monailabel:latest
docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \
    projectmonai/monailabel:latest monailabel start_server \
    --app /opt/monai/sample-apps/radiology \
    --studies /opt/monai/datasets/Task09_Spleen/imagesTr \
    --conf models segmentation

Verify server is running
curl http://localhost:8000/info/

Step 1 — Establish baseline (legitimate data works):

curl -X POST "http://localhost:8000/infer/segmentation?image=spleen_40" \
     -o baseline.nii.gz -w "HTTP %{http_code} - %{size_download} bytes"
# Result: HTTP 200, ~223,628 bytes valid segmentation mask

Step 2 — Run the attack (NaN DICOM upload + inference):

pip install pydicom numpy requests
python poc_monailabel_ds_bypass.py --server http://localhost:8000

The PoC script:

1. Confirms pydicom accepts NaN/inf in DS fields
2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient
3. 3. Uploads each via PUT /datastore/ (no auth required) — HTTP 200 accepted
4. 4. Triggers inference via POST /infer/segmentation — HTTP 500, server crash Demonstrated Results:

Server crash traceback:

monailabel/tasks/infer/basic_infer.py → self.writer(data)
monailabel/transform/writer.py → write_itk(...)
itk/ITKCommonBasePython.py → itkProcessObject_Update()
RuntimeError: itkGDCMImageIO.cxx:1226:
  ITK ERROR: GDCMImageIO: A Floating point buffer was passed
  but the stored pixel type was not specified.

Each request burns ~16 seconds of server compute (full ML inference pipeline) before crashing. The NaN DICOM persists in the datastore — any future inference on that image ID crashes the server again.

Library-level confirmation: 17/17 test vectors confirmed against MONAI 1.5.2 and pydicom 3.0.2, including actual MONAI LoadImaged and Spacingd transforms accepting NaN geometry without error.

Note: The PoC section describes a MONAILabel server running in Docker with the radiology sample app, tested against MONAI 1.5.2 and pydicom 3.0.2.

• GitHub Advisory
• GitHub Commit
• GitHub Release