PT-2022-22984 · Inductive Automation · Inductive Automation Ignition

20Urdjk · Published 2022-07-15 · Updated 2022-08-03 · CVE-2022-35873

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 8.1.15 (b2022030114)

Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of ZIP files, where crafted data can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard, and an attacker can leverage this to execute code in the context of SYSTEM.

Recommendations For Inductive Automation Ignition version 8.1.15 (b2022030114), consider disabling the processing of ZIP files until a patch is available to prevent the execution of arbitrary Python scripts. Restrict access to the user interface to minimize the risk of exploitation. Avoid using crafted ZIP files in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-356

Related Identifiers

CVE-2022-35873

ZDI-22-1020

Affected Products

Inductive Automation Ignition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-35873 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35873 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1020 · Security Note
• https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities · Vendor Advisory
• https://t.me/cibsecurity/46958 · Telegram Post