Remote File Write in SIMATIC S7 .NET Client Library

Executive Summary

This is a path traversal vulnerability in the .NET Client Library for SIMATIC S7 Webserver API. It occurs because the library fails to properly validate filenames received from remote servers during ticket downloads. An attacker who can manipulate ticket responses could write arbitrary files outside the intended download directory or overwrite existing files accessible to the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your .NET Client Library for SIMATIC S7 Webserver API is running a version older than V3.3.61. Inspect network traffic for unusual file download requests or responses that include path traversal sequences like '../'. Monitor file system changes outside the intended download directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to overwrite critical files, disrupt operations, or execute malicious code on systems using the affected library. It may lead to unauthorized data access, system compromise, or denial of service if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes or overwrites outside intended directories, potentially exposing sensitive data. This may violate compliance requirements for data protection such as GDPR (data integrity and confidentiality) and HIPAA (secure handling of protected health information) by enabling unauthorized access or modification of critical files.

Useful 0 Not Useful 0

Mitigation Strategies

Update the .NET Client Library for SIMATIC S7 Webserver API to version V3.3.61 or later as recommended by Siemens to address the path traversal vulnerability.

Useful 0 Not Useful 0