CVE-2022-35873

Ignition 8.1.15 ZIP code execution

• CVSS 7.8
• CWE-356 Product UI does not Warn User of Unsafe Actions
• Input Validation and Sanitization
• Remote

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16949.

CVE

CVE-2022-35873

CWE

CWE-356 Product UI does not Warn User of Unsafe Actions

CVSS base score

7.8

Published

2022-07-25

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Inductive Automation Ignition to version 8.1.16 or higher.

import zipfile

def extract_zip(zip_file_path, extract_to='.'):
    with zipfile.ZipFile(zip_file_path) as zf:
        zf.extractall(extract_to)

extract_zip('example.zip', 'extracted_files')

import zipfile
import os

def extract_zip(zip_file_path, extract_to='.'):
    with zipfile.ZipFile(zip_file_path) as zf:
        for member in zf.namelist():
            if os.path.isabs(member) or '..' in member.split(os.path.sep):
                raise Exception("Attempted Path Traversal in ZIP file")
        zf.extractall(extract_to)

try:
    extract_zip('mexample.zip', 'extracted_files')
except Exception as e:
    print(f"Error: {e}")

@misc{vaitp:cve202235873,
  title        = {{Ignition 8.1.15 ZIP code execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-35873},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-35873/}}
}