// For flags

CVE-2022-1373

Softing Secure Integration Server Relative Path Traversal

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.

La funcionalidad de "restore configuration" de Softing Secure Integration Server versión V1.22 ,es susceptible a una vulnerabilidad de salto de directorio cuando son procesados archivos zip. Un atacante puede diseñar un archivo zip para cargar una DLL arbitraria y ejecutar código. El uso de la funcionalidad "restore configuration" para cargar un archivo zip que contenga un archivo de cruce de ruta puede causar la creación de un archivo y su ejecución al tocar el disco.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the Zip::UnZipFolder method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

*Credits: Pedro Ribeiro and Radek Domanski, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to Softing and CISA.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-04-14 CVE Reserved
  • 2022-08-17 CVE Published
  • 2024-06-05 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-23: Relative Path Traversal
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Softing
Search vendor "Softing"
 Edgeaggregator
Search vendor "Softing" for product "Edgeaggregator"
 3.1
Search vendor "Softing" for product "Edgeaggregator" and version "3.1"
-
Affected
Softing
Search vendor "Softing"
 Edgeconnector
Search vendor "Softing" for product "Edgeconnector"
 3.1
Search vendor "Softing" for product "Edgeconnector" and version "3.1"
-
Affected
Softing
Search vendor "Softing"
 Opc
Search vendor "Softing" for product "Opc"
 5.2
Search vendor "Softing" for product "Opc" and version "5.2"
-
Affected
Softing
Search vendor "Softing"
 Opc Ua C\+\+ Software Development Kit
Search vendor "Softing" for product "Opc Ua C\+\+ Software Development Kit"
 6
Search vendor "Softing" for product "Opc Ua C\+\+ Software Development Kit" and version "6"
-
Affected
Softing
Search vendor "Softing"
 Secure Integration Server
Search vendor "Softing" for product "Secure Integration Server"
 1.22
Search vendor "Softing" for product "Secure Integration Server" and version "1.22"
-
Affected
Softing
Search vendor "Softing"
 Uagates
Search vendor "Softing" for product "Uagates"
 1.74
Search vendor "Softing" for product "Uagates" and version "1.74"
-
Affected