CVE-2022-35871

Ignition 8.1.15 Auth Bypass RCE, ZDI-CAN-17206

• CVSS 7.8
• CWE-306 Missing Authentication for Critical Function
• Authentication, Authorization, and Session Management
• Remote

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17206.

CVE

CVE-2022-35871

CWE

CWE-306 Missing Authentication for Critical Function

CVSS base score

7.8

Published

2022-07-25

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Inductive Automation Ignition to version 8.1.16 or higher.

def authenticateAdSso(user_token):
    """Vulnerable function that demonstrates the security issue."""
    execute_user_code(user_token)

def execute_user_code(user_token):
    """Vulnerable function that demonstrates the security issue."""
    exec(user_token)

BLACKLIST = [
    'import', 'os', 'sys', 'eval', 'exec', 'subprocess', 'open', 'socket', 'os.system'
]

def authenticateAdSso(user_token):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    if not is_authenticated(user_token):
        raise PermissionError("Authentication required to execute this method.")
    execute_user_code(user_token)

def is_authenticated(user_token):
    """Secure function that fixes the vulnerability."""
    return user_token in valid_tokens

def execute_user_code(user_token):
    """Secure function that fixes the vulnerability."""
    user_code = get_user_code(user_token)
    for blacklisted_command in BLACKLIST:
        if blacklisted_command in user_code:
            raise PermissionError(f"Execution of '{blacklisted_command}' is not allowed.")
    exec(user_code)

def get_user_code(user_token):
    """Secure function that fixes the vulnerability."""
    return "print('Hello, World!')"

@misc{vaitp:cve202235871,
  title        = {{Ignition 8.1.15 Auth Bypass RCE, ZDI-CAN-17206}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-35871},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-35871/}}
}