Attack Chain

1. Attacker identifies a target MONAILabel server with an exposed REST API (default port 8000).
2. Attacker crafts a DICOM file with NaN or infinity values injected into mandatory spatial DS tags (e.g., PixelSpacing, ImagePositionPatient).
3. Attacker submits the crafted file to the server's PUT /datastore/ endpoint without requiring authentication.
4. The MONAILabel server stores the malicious DICOM file in its permanent datastore.
5. Attacker triggers a standard inference request via POST /infer/ targeting the stored malicious image ID.
6. The MONAI PydicomReader and downstream transforms (LoadImaged/Spacingd) process the NaN/inf values without validation.
7. The inference pipeline crashes with a RuntimeError or produces corrupted AI output depending on the transform stage.

Impact

• Denial of Service: Repeated crashes of the inference service consuming server CPU and memory.
• Data Corruption: Silent production of incorrect AI segmentation masks when the pipeline does not immediately crash.
• Persistence: Malicious DICOM files remain in the datastore, causing recurrent failures upon future inference requests.

Recommendation

• Patch MONAILabel and MONAI Core to version 1.6.1 or later immediately.
• Implement strict input validation for spatial metadata on all API-exposed upload endpoints before storing files.
• Restrict network access to the MONAILabel REST API to authorized internal networks only.
• Implement Authentication and Authorization (RBAC) for all MONAILabel API endpoints to prevent unauthenticated uploads.
• Deploy monitoring for RuntimeError and itkGDCMImageIO related exceptions in inference server logs.