PT-2022-22981 · Inductive Automation · Inductive Automation Ignition

S_N_T · Published 2022-07-15 · Updated 2022-08-03 · CVE-2022-35870

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 8.1.15 (b2022030114)

Description This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM.

Recommendations For version 8.1.15 (b2022030114), consider disabling the deserialization of untrusted data within com.inductiveautomation.metro.impl as a temporary workaround until a patch is available. Restrict access to the affected module to minimize the risk of exploitation. Avoid using user-supplied data in the affected implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-35870

ZDI-22-1017

Affected Products

Inductive Automation Ignition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-35870 · Security Note
• https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35870 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1017 · Security Note
• https://t.me/cibsecurity/46959 · Telegram Post