CVE-2022-35873
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Inductive Automation Ignition installations by tricking users into opening malicious ZIP files. The flaw in ZIP file processing enables execution of arbitrary Python scripts with SYSTEM privileges. All users of affected Ignition versions are at risk.
💻 Affected Systems
- Inductive Automation Ignition
📦 What is this software?
Ignition by Inductiveautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, steal data, pivot to other systems, or disrupt industrial operations.
Likely Case
Attacker gains initial foothold on the system, then escalates privileges and deploys ransomware or establishes persistence for further attacks.
If Mitigated
Limited impact due to network segmentation, application whitelisting, and user awareness preventing malicious ZIP file execution.
🎯 Exploit Status
Exploited at Pwn2Own 2022 (ZDI-CAN-16949). Requires social engineering to deliver malicious ZIP file but technical exploitation is straightforward once file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.16 or later
Vendor Advisory: https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities
Restart Required: Yes
Instructions:
1. Download Ignition 8.1.16 or later from Inductive Automation portal. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart Ignition services. 5. Verify version in About dialog.
🔧 Temporary Workarounds
Restrict ZIP file processing
allBlock or restrict processing of ZIP files through Ignition's file handling mechanisms
User awareness training
allTrain users to never open ZIP files from untrusted sources in Ignition
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized Python scripts
- Network segmentation to isolate Ignition systems from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check Ignition version in About dialog - if version is 8.1.15 (b2022030114) or earlier, system is vulnerable.Check Version:
Check Ignition Gateway Web UI -> About dialog or examine installation directory version filesVerify Fix Applied:
Verify version is 8.1.16 or later in About dialog and test ZIP file processing functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Python script execution events
- ZIP file processing errors
- Unexpected SYSTEM privilege processes spawned from Ignition
Network Indicators:
- Outbound connections from Ignition to unknown IPs
- Unusual data exfiltration patterns
SIEM Query:
Process creation where parent_process contains 'ignition' AND (process contains 'python' OR process contains 'cmd' OR process contains 'powershell')🔗 References
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities
- https://www.zerodayinitiative.com/advisories/ZDI-22-1020/
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities
- https://www.zerodayinitiative.com/advisories/ZDI-22-1020/
