CVE-2023-38121

The vulnerability results from insufficient validation of user-supplied data in the 'id' parameter of the Ignition OPC UA Quick Client web interface. An attacker can inject arbitrary JavaScript code (XSS), which will be executed in the victim's browser context. By leveraging this technique, the attacker can escalate the attack to achieve code execution at the operating system level (RCE). For the exploit to work, the victim must visit a malicious website or open a malicious file.

An attacker can execute arbitrary code in the context of the SYSTEM account on the targeted installation, resulting in complete system compromise, including access to sensitive data, configuration modification, and potential disruption of industrial processes handled by Ignition.

Apply patches available from the vendor according to the references. Inductive Automation has published patch information related to Pwn2Own participation — details are available on the vendor's website and in the ZDI-23-1012 advisory.

Inductive Automation Ignition installations — specific versions indicated in the vendor's references and in the Zero Day Initiative advisory (ZDI-23-1012)