Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-42845-Exploit — Exploit For: CVE-2024-42845: Remote Code Execution (RCE) in Invesalius 3.1 | Kitploit
Tools/GitHubGitHub/theexploiters/cve-2024-42845-exploit
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationMalware Analysis
GitHubtheexploiters/cve-2024-42845-exploit

CVE-2024-42845-Exploit

Exploit For: CVE-2024-42845: Remote Code Execution (RCE) in Invesalius 3.1

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
261 year agoNot yet reviewed
Share

CVE-2024-42845: Remote Code Execution (RCE) in Invesalius 3.1

Exploit Details

  • Exploit Title: Invesalius 3.1 - Remote Code Execution (RCE)
  • Discovered By: Alessio Romano (sfoffo), Riccardo Degli Esposti (partywave)
  • Exploit Author: Alessio Romano (sfoffo), Riccardo Degli Esposti (partywave)
  • Date: 2024-08-23
  • Vendor Homepage: Invesalius
  • Software Link: Invesalius GitHub Repository
  • Version: 3.1.99991 to 3.1.99998
  • Tested on: Windows
  • CVE: CVE-2024-42845

External References

  • Sfoffo Notes
  • GitHub - partywavesec
  • Partywave Research

Description

A Remote Code Execution (RCE) vulnerability has been identified in the DICOM file import procedure of Invesalius3. Versions affected range from 3.1.99991 to 3.1.99998. The vulnerability allows attackers to execute arbitrary code by tricking the victim into importing a crafted DICOM file into the application.

Exploit Details

Vulnerability

The vulnerability is triggered by importing a maliciously crafted DICOM file, allowing the attacker to execute arbitrary code on the victim's machine.

Impact

  • Remote Code Execution: The crafted DICOM file can execute arbitrary code on the victim's machine upon import.
  • System Compromise: An attacker can gain control over the victim's machine, potentially leading to data theft or further exploitation.

Usage

  1. Prepare a DICOM File: Obtain a valid DICOM file for modification.
  2. Craft Payload: Use the script to inject the payload into the DICOM file.
  3. Import into Invesalius3: The victim imports the crafted file, triggering the RCE.

Mitigation

Users are advised to update to a version of Invesalius3 that is not affected by this vulnerability and to be cautious when importing DICOM files from untrusted sources.

Credits

  • Alessio Romano (sfoffo)
  • Riccardo Degli Esposti (partywave)

Disclaimer: This document is for educational purposes only. Unauthorized exploitation of vulnerabilities is illegal and unethical.

Repo View Counter

Download Tool