External risk intelligence

Medisys Weblab SQL Injection Vulnerability in WSDL Files

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-29863

The vulnerability affects a medical laboratory information system. Such systems are typically deployed within isolated hospital or laboratory internal networks to protect patient data and comply with privacy regulations, making direct public internet exposure uncommon despite the network-based nature of the flaw.

SQL Injection

Medisys Weblab

19.4.03

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Medical Systems Co.'s Weblab Products that could allow unauthorized access and modification of data. This issue lies within the WebLab's WSDL files and could be exploited remotely. The primary concern is to confirm if this specific system is in use and if it is exposed externally.

Flaw allows remote data access and modification.
Critical flaw in medical lab systems demands attention.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the product's WSDL files. This request, targeting the `tem:statement` parameter, would allow the attacker to inject malicious SQL commands. If successful, this injection could lead to unauthorized access, modification, or deletion of sensitive data within the system.

No authentication is required.
A web request triggers the vulnerability.
Risk includes unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in Medisys Weblab's WSDL files could allow an unauthenticated attacker to manipulate database queries via the `tem:statement` parameter. When supported by the advisory's context, this could potentially lead to unauthorized access, modification, or disclosure of sensitive system and user data managed by the Weblab system.

Database queries and patient data.
Through specially crafted WSDL requests.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Medical Systems Co. Medisys Weblab, likely managed by application owners and potentially overseen by infrastructure or platform teams responsible for the underlying systems. The first crucial step is for these teams to locate all instances of the affected technology, assess its exposure and criticality, identify the accountable owner for each instance, and then develop a risk-based remediation plan.

Application owners should coordinate remediation.
Verify system accessibility and business criticality first.
Plan maintenance and vendor coordination for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Medisys Weblab?

Medisys Weblab is a specialized software platform used by medical laboratories to manage critical clinical information, testing workflows, and patient data. It functions as an information system that orchestrates how lab data is processed and stored within healthcare environments.

What is the vulnerability in CVE-2023-29863?

This CVE involves a SQL injection vulnerability, categorized as CWE-89. It means the software fails to properly sanitize user input, allowing an attacker to inject and execute their own database commands. In this case, the weakness exists within the system's WSDL files, which are used to define web service communications.

How does an attacker trigger this SQL injection?

An attacker triggers the flaw by sending a specifically crafted request to the system's WSDL files using the 'tem:statement' parameter. The system is not vulnerable to requests that do not specifically target this parameter or fail to provide the malformed SQL content required to manipulate the backend database queries.

Is my Medisys Weblab system at risk?

Halo Surface Signal notes that while the flaw is network-based, Medisys Weblab is typically deployed within isolated hospital or laboratory internal networks. Your primary concern is whether any instance of this software has been inadvertently exposed to the public internet, as internal systems are generally shielded from external remote exploitation.

How should I respond to this threat?

Begin by auditing your infrastructure to locate all active installations of Medisys Weblab. Once identified, confirm if these systems are accessible from the internet and evaluate their business criticality. Coordinate with your application owners to oversee the necessary remediation steps and verify if the vendor has provided updates to secure the affected WSDL configuration.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.