PT-2022-22983 · Inductive Automation · Inductive Automation Ignition

Chudypb + 1 · Published 2022-07-15 · Updated 2022-08-03 · CVE-2022-35872

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 8.1.15 (b2022030114)

Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of ZIP files due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. An attacker can leverage this to execute code in the context of SYSTEM.

Recommendations For Inductive Automation Ignition version 8.1.15 (b2022030114), consider disabling the ZIP file parsing functionality until a patch is available to prevent deserialization of untrusted data. Restrict access to the system to minimize the risk of exploitation. Avoid using user-supplied data in the affected parsing functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-35872

ZDI-22-1019

Affected Products

Inductive Automation Ignition

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-1019 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35872 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35872 · Vendor Advisory
• https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities · Vendor Advisory
• https://t.me/cibsecurity/46960 · Telegram Post