CVE-2020-25237

Siemens SINEC NMS FirmwareFileUtils extractToFolder Directory Traversal Remote Code Execution Vulnerability

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)

Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP1 Update 1), SINEMA Server (Todas las versiones anteriores a V14.0 SP2 Update 2). Cuando se cargan archivos en un sistema afectado mediante un contenedor zip, el sistema no verifica correctamente si la ruta de archivo relativa de los archivos extraídos todavía se encuentra dentro del directorio de destino previsto. Con esto, un atacante podría crear o sobrescribir archivos arbitrarios en un sistema afectado. Este tipo de vulnerabilidad también se conoce como "Zip-Slip". (ZDI?CAN?12054)

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens SINEC NMS. Authentication is required to exploit this vulnerability.
The specific flaw exists within the FirmwareFileUtils class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

*Credits: rgod

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-09-10 CVE Reserved
2021-02-09 CVE Published
2024-08-04 CVE Updated
2024-10-09 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (3)

URL	Tag	Source
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-03	Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-253	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-156833.pdf	2021-03-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Sinec Network Management System Search vendor "Siemens" for product "Sinec Network Management System"				< 1.0 Search vendor "Siemens" for product "Sinec Network Management System" and version " < 1.0"		-		Affected
Siemens Search vendor "Siemens"		Sinec Network Management System Search vendor "Siemens" for product "Sinec Network Management System"				1.0 Search vendor "Siemens" for product "Sinec Network Management System" and version "1.0"		-		Affected
Siemens Search vendor "Siemens"		Sinec Network Management System Search vendor "Siemens" for product "Sinec Network Management System"				1.0 Search vendor "Siemens" for product "Sinec Network Management System" and version "1.0"		sp1		Affected
Siemens Search vendor "Siemens"		Sinema Server Search vendor "Siemens" for product "Sinema Server"				< 14.0 Search vendor "Siemens" for product "Sinema Server" and version " < 14.0"		-		Affected
Siemens Search vendor "Siemens"		Sinema Server Search vendor "Siemens" for product "Sinema Server"				14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0"		-		Affected
Siemens Search vendor "Siemens"		Sinema Server Search vendor "Siemens" for product "Sinema Server"				14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0"		sp1		Affected
Siemens Search vendor "Siemens"		Sinema Server Search vendor "Siemens" for product "Sinema Server"				14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0"		sp2		Affected
Siemens Search vendor "Siemens"		Sinema Server Search vendor "Siemens" for product "Sinema Server"				14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0"		sp2_update1		Affected