Siemens SINEC INS Path Traversal Vulnerability in SFTP File Upload Endpoint

A path traversal vulnerability has been identified in Siemens SINEC INS, all versions prior to V1.0 SP2 Update 6. The issue arises in the 'GET /api/sftp/uploadFiles' endpoint, which is used for directory listing. The application fails to properly sanitize path input, allowing crafted input to traverse directories and access unintended file system locations.

Impact

Exploitation of this vulnerability could lead to unauthorized access to restricted file system areas, potentially allowing for the manipulation or extraction of sensitive files.

Remediation

Users are advised to update to Siemens SINEC INS V1.0 SP2 Update 6 or later. For more information, visit the Siemens Industry Support page.