Full Report
The latest update for SIMATIC WinCC fixes a vulnerability in the SIMATIC WinCC DataMonitor web application of the affected products that allows to upload arbitrary ASPX code. An attacker has to be authenticated with a valid user account. The vulnerability is only relevant for scenarios where access via the web interface is feasible for an attacker while access to the directory structure is not. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and recommends specific countermeasures until patches are available.
Analysis Summary
# Vulnerability: Arbitrary ASPX File Upload in SIMATIC WinCC DataMonitor
## CVE Details
- **CVE ID:** CVE-2024-45283 (Note: Based on Siemens security advisory SSA-347071)
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-434: Unrestricted Upload of File with Dangerous Type
## Affected Systems
- **Products:** SIMATIC WinCC, SIMATIC WinCC DataMonitor
- **Versions:** Affected versions prior to the latest security updates (e.g., WinCC v7.4, v7.5, v8.0)
- **Configurations:** Systems where the DataMonitor web application is enabled and accessible via a network interface.
## Vulnerability Description
A vulnerability exists in the SIMATIC WinCC DataMonitor web application that allows an authenticated user to upload arbitrary files to the server. Specifically, the application fails to properly validate file extensions or content, allowing for the upload of `.aspx` files. If these files are placed in a web-accessible directory, they can be executed by the web server, leading to Remote Code Execution (RCE) in the context of the web service.
## Exploitation
- **Status:** Not currently reported as exploited in the wild (PoC not publicly detailed in the provided context).
- **Complexity:** Low (Requires valid user credentials).
- **Attack Vector:** Network (Web Interface).
## Impact
- **Confidentiality:** High (Full access to data accessible by the web server process).
- **Integrity:** High (Ability to modify application files and system configuration).
- **Availability:** High (Potential for system instability or intentional service disruption).
## Remediation
### Patches
Siemens has released updates for several affected versions. Users are advised to:
- Update to **SIMATIC WinCC V8.0 Update 4** or later.
- Update to **SIMATIC WinCC V7.5 SP2 Update 17** or later.
- Check the Siemens ProductCERT for specific version updates regarding WinCC V7.4 and other legacy versions.
### Workarounds
- **Restrict Access:** Limit access to the DataMonitor web interface to trusted users and internal networks only.
- **Permission Hardening:** Ensure the web service account has the least privilege necessary and cannot write to directories where execution is permitted, if possible.
- **Disable Unused Services:** Disable the DataMonitor feature if it is not required for operational needs.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected `.aspx` files in the DataMonitor web directory (typically within the `inetpub\wwwroot` structure).
- Unusual web server logs showing POST requests to upload handlers from unexpected user accounts.
- **Detection methods:** Use Endpoint Detection and Response (EDR) to monitor for the `w3wp.exe` process spawning suspicious child processes (e.g., `cmd.exe`, `powershell.exe`).
## References
- **Siemens ProductCERT:** hxxps[://]www[.]siemens[.]com/cert/advisories
- **Advisory Link:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-347071[.]pdf