CVE-2023-38123
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication in Inductive Automation Ignition OPC UA Quick Client by exploiting missing authentication on password change functionality. Attackers can gain unauthorized access when users visit malicious pages or open malicious files. This affects all installations using vulnerable versions of Ignition.
💻 Affected Systems
- Inductive Automation Ignition OPC UA Quick Client
📦 What is this software?
Ignition by Inductiveautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to change passwords, gain administrative access, and potentially execute arbitrary code on Ignition servers.
Likely Case
Unauthorized access to Ignition systems allowing data theft, configuration changes, and disruption of industrial control operations.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires user interaction but is technically simple once the malicious payload is delivered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.30 and later
Vendor Advisory: https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
Restart Required: Yes
Instructions:
1. Download Ignition version 8.1.30 or later from Inductive Automation portal. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart Ignition services.
🔧 Temporary Workarounds
Disable OPC UA Quick Client
allRemove or disable the vulnerable OPC UA Quick Client component if not required for operations.
Navigate to Ignition Gateway > Config > OPC UA > Quick Client > Disable
Network Segmentation
allIsolate Ignition systems from untrusted networks and implement strict firewall rules.
Configure firewall to block external access to Ignition ports (typically 8060, 8043)
🧯 If You Can't Patch
- Implement strict user awareness training to prevent opening malicious files/links
- Deploy application whitelisting to prevent execution of unauthorized scripts
🔍 How to Verify
Check if Vulnerable:
Check Ignition version in Gateway webpage or via command: java -jar ignition.jar --versionCheck Version:
java -jar ignition.jar --versionVerify Fix Applied:
Verify version is 8.1.30 or higher and OPC UA Quick Client authentication is enforced📡 Detection & Monitoring
Log Indicators:
- Unauthorized password change attempts
- OPC UA Quick Client authentication failures
- Unexpected user privilege changes
Network Indicators:
- Unusual OPC UA traffic patterns
- Authentication bypass attempts to Ignition ports
SIEM Query:
source="ignition" AND (event_type="auth_failure" OR event_type="password_change")🔗 References
- https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
- https://www.zerodayinitiative.com/advisories/ZDI-23-1014/
- https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security
- https://www.zerodayinitiative.com/advisories/ZDI-23-1014/
