Full Report
Siemens Simcenter Femap versions before V2022.1.2 are affected by vulnerabilities that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code execution in the context of the current process. Siemens recommends to update to the latest version line of Simcenter Femap and to avoid opening of untrusted files from unknown sources.
Analysis Summary
# Vulnerability: Multiple Memory Corruptions in Siemens Simcenter Femap .NEU File Parsing
## CVE Details
- **CVE ID:** CVE-2022-29837 (and associated vulnerabilities typically reported in SSA-655615)
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** Siemens Simcenter Femap
- **Versions:** All versions prior to V2022.1.2
- **Configurations:** Systems where the application is used to process Neutral (.NEU) files.
## Vulnerability Description
Simcenter Femap contains multiple memory corruption vulnerabilities within its parsing engine for `.NEU` (Neutral) files. The flaws occur when the application fails to properly validate user-supplied data while reading these files. Specifically, an attacker can craft a malicious `.NEU` file that, when parsed, triggers an out-of-bounds read or write. This can lead to the disclosure of sensitive information from the process memory or allow for the hijacking of the execution flow.
## Exploitation
- **Status:** Not exploited in the wild (as of initial report); PoC exists internally/for research.
- **Complexity:** Medium (Requires crafting a specific file format and successful social engineering).
- **Attack Vector:** Local (User-assisted). The attacker must trick a user into opening a malicious file.
## Impact
- **Confidentiality:** High (Potential for sensitive information leakage).
- **Integrity:** High (Potential for Remote Code Execution).
- **Availability:** High (Potential for application crash/Denial of Service).
## Remediation
### Patches
- **Siemens Simcenter Femap V2022.1.2:** Update to this version or any subsequent releases to resolve the identified flaws.
### Workarounds
- **Strict File Handling:** Do not open `.NEU` files received from untrusted, unknown, or unexpected sources.
- **Principle of Least Privilege:** Run the application under a user account with minimal required privileges to limit the impact of potential code execution.
## Detection
- **Indicators of Compromise:** Unexpected application crashes when opening `.NEU` files; unusual outbound network traffic originating from the `femap.exe` process following the opening of an untrusted file.
- **Detection Methods:** Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by Simcenter Femap. Implement file integrity scanning for incoming CAD/CAE files.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-655615[.]pdf
- **MITRE CVE:** hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2022-29837