CVE-2023-38121
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Inductive Automation Ignition's OPC UA Quick Client web interface that allows remote code execution. Attackers can inject malicious scripts via the id parameter, potentially executing arbitrary code with SYSTEM privileges. Users of affected Ignition installations who access malicious pages or files are at risk.
💻 Affected Systems
- Inductive Automation Ignition
📦 What is this software?
Ignition by Inductiveautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Session hijacking, credential theft, or installation of backdoors on affected Ignition servers.
If Mitigated
Limited to client-side script execution without SYSTEM privileges if proper input validation and output encoding are implemented.
🎯 Exploit Status
User interaction required (visiting malicious page), but exploit chain is straightforward once malicious payload is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references, but vendor has released patches.
Vendor Advisory: https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
Restart Required: Yes
Instructions:
1. Check current Ignition version. 2. Download latest patch from Inductive Automation portal. 3. Apply patch following vendor instructions. 4. Restart Ignition services.
🔧 Temporary Workarounds
Disable OPC UA Quick Client
allTemporarily disable the vulnerable OPC UA Quick Client component if not required.
Navigate to Ignition Gateway > Config > OPC UA > Quick Client > Disable
Network Segmentation
allRestrict access to Ignition web interface to trusted networks only.
Configure firewall rules to limit access to Ignition ports (typically 8088, 8043)
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user-supplied parameters in custom scripts.
- Deploy web application firewall (WAF) with XSS protection rules in front of Ignition interface.
🔍 How to Verify
Check if Vulnerable:
Check if Ignition version is before patched release and OPC UA Quick Client is enabled.Check Version:
Check Ignition Gateway status page or About dialog for version information.Verify Fix Applied:
Verify Ignition version is updated to patched release and test id parameter for script injection.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in id parameter logs
- Multiple failed script injection attempts
Network Indicators:
- HTTP requests with suspicious script payloads in id parameter
- Unusual outbound connections from Ignition server
SIEM Query:
source="ignition" AND (id CONTAINS "<script>" OR id CONTAINS "javascript:")🔗 References
- https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
- https://www.zerodayinitiative.com/advisories/ZDI-23-1012/
- https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
- https://www.zerodayinitiative.com/advisories/ZDI-23-1012/
