-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-199605: Arbitrary File Download Vulnerability in SIMATIC eaSie PCS 7 Skill
Package

Publication Date:        2021-12-14
Last Update:             2021-12-14
Current Version:         1.0
CVSS v3.1 Base Score:    6.5

SUMMARY
=======

SIMATIC eaSie PCS 7 Skill Package contains a path traversal
vulnerability that could allow an authenticated remote attacker to read
arbitrary files for the application server.

Siemens has released an update for the SIMATIC eaSie PCS 7 Skill Package
and recommends to update to the latest version.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)
  - Affected versions:
       All versions < V21.00 SP3
  - Remediation:
       Update to V21.00 SP3 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109795919


WORKAROUNDS AND MITIGATIONS
===========================


Siemens has not identified any additional specific workarounds or mitigations.
Please follow the "General Security Recommendations".

Product specific mitigations can be found in the section "Affected Products and Solution".

GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

SIMATIC eaSie is a digital assistant for automation and process control
technology in the Siemens automation concept, "Totally Integrated
Automation".

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2021-42022

  When downloading files, the affected systems do not properly neutralize
  special elements within the pathname. An attacker could then cause the
  pathname to resolve to a location outside of the restricted directory on
  the server and read unexpected critical files. The affected file
  download function is disabled by default.

  CVSS v3.1 Base Score: 6.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
  CWE:                  CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal')




ADDITIONAL INFORMATION
======================
This vulnerability has been discovered internally by Siemens.

For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2021-12-14): Publication Date

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEHyx/myPwjH9jB9tDlm7gTEmyujQFAmG33oAACgkQlm7gTEmy
ujSAtxAAjTk7j4+aylyOkGSpuC7FfpOk/sLiKi2ArFYNr7UdAtLMfOFVhMqLJZM8
h5+Gt6mzxJQd6gb2rD8gxxmjMD9aNKfPUtexAsueg69ltKlF+HraTg59j09a7mSE
qOBt94dxQ3zZx7NZxDf7c4NL6OwEcMgTqTUyf/hu6xYxOlvHiwwqfC1b/AVEi89V
59QSgO97VhXl8tKDVF86LnB91zqDgiThF3vm670Pbw1hXBbg4+5ACpkJ54CahAoW
YeMPHhgmnJ+1GWhZe8jz1q88vGO0X3bqB+HzfmtmcU9vaMxU4l4T5NBRG1PA3zzx
7Wl3eTAKCt3KnMoGRQtjcgYn9AbA9fjk+dFO4C1QxrUTfiIgLpHqKv66Rs913HY5
ldIAj6XzYBWiiJHbwSMTp8QCXYVd0ge/DF9KcIMsSKO0jsI+ks82b/+Qt64el5se
Oa8xFBOnxH6NTAmdhZriAJtQgtaKGZT/M9xMVUJuC6MfSH9dh2kp79stJMcBwbJa
cWDT/3pC5S4e2FiehLI/qfUIa/RwC5k1vCR+mMFI+skUQP/dhZ5QdGnzNefxsw+O
Wa1yK7UjPlInQWA2hJ3ssBhdcZvTLlcckPrdylh8ra+DuFTUwe1hpos8JDSgXJ/d
MwGbLL3eAajCdzY/0FcYbdWnFk3k4rXyNbO8SOiXcgMBICMoAzs=
=mhOh
-----END PGP SIGNATURE-----