#######################################################################

                             Luigi Auriemma

Application:  Siemens Tecnomatix FactoryLink
              http://www.usdata.com/sea/FactoryLink/en/p_nav1.html
              http://www.plm.automation.siemens.com/en_us/products/tecnomatix/production_management/factorylink/index.shtml
Versions:     <= 8.0.1.1473
Platforms:    Windows
Bug:          arbitrary files reading and listing
Exploitation: remote, versus server
Date:         21 Mar 2011 (found 02 Jan 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"Siemens FactoryLink monitors, supervises, and controls industrial
processes by enabling customers to perfect their processes and
products. Built on an advanced open architecture, FactoryLink delivers
the highest performance and flexibility to customers building vertical
applications in a wide range of industries.
Highly scaleable, FactoryLink can be used to build virtually any size
application, from the simplest Human-Machine Interface (HMI) systems to
the most complex and demanding Supervisory Control and Data Acquisition
(SCADA) systems."


#######################################################################

======
2) Bug
======


CSService is a Windows service listening on port 7580.

All the file operations used by the service (opcodes 6, 8 and 10) allow
to specify arbitrary files and directories (absolute paths) and it's
possible for an attacker to download any remote file on the server.
Obviously it's possible also to specify directory traversal paths.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/factorylink_x.zip

for downloading c:\boot.ini
  factorylink_x 4 SERVER

for viewing the list of files in c:\
  factorylink_x 5 SERVER


#######################################################################

======
4) Fix
======


No fix.

UPDATE 25 Mar 2011:
version 802.82


#######################################################################