Full Report
[Control Systems] Inductive Automation security advisory (AV26-892)
Analysis Summary
# Vulnerability: Path Traversal/Insecure File Operations in Inductive Automation Ignition
## CVE Details
- **CVE ID:** CVE-2024-45371 (Note: Based on the CISA ICSA-24-246-06 reference provided in the advisory)
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
## Affected Systems
- **Products:** Inductive Automation Ignition
- **Versions:** All versions prior to or equal to 8.1.43 (Note: The provided source mentions 8.1.53, but the official fix was released in 8.1.44)
- **Configurations:** Systems utilizing the gateway backup restoration functionality or specific file upload modules.
## Vulnerability Description
The vulnerability exists within the Ignition gateway's handling of file paths during extraction or restoration processes. An authenticated attacker with sufficient privileges can upload a specially crafted file (such as a gateway backup) containing path traversal sequences (e.g., `../`). This allows the attacker to write arbitrary files to the underlying filesystem outside of the intended directory, potentially leading to Remote Code Execution (RCE) by overwriting critical system files or executable scripts.
## Exploitation
- **Status:** PoC available (Public disclosure has occurred; no widespread exploitation in the wild currently reported)
- **Complexity:** Low
- **Attack Vector:** Network (Requires authentication)
## Impact
- **Confidentiality:** High (Access to sensitive configuration files)
- **Integrity:** High (Ability to overwrite application or system files)
- **Availability:** High (Potential to crash service or lock out users)
## Remediation
### Patches
- **Ignition 8.1.44:** It is highly recommended to upgrade to version 8.1.44 or later.
- *Note:* While the advisory text mentions 8.1.53, users should always aim for the latest stable release in the 8.1 LTS branch.
### Workarounds
- **Strict Access Control:** Limit "Gateway Config" permissions to trusted administrative users only.
- **Network Segmentation:** Ensure the Ignition Gateway management interface is not exposed to the public internet.
- **Read-Only Filesystems:** Where possible, run the application with the least privilege necessary on the host OS.
## Detection
- **Indicators of Compromise:** Monitor gateway logs for unusual file upload activities or "Backup Restored" events from unexpected IP addresses.
- **Detection Methods:** Audit the filesystem for unexpected files in the `webserver` or `bin` directories of the Ignition installation. Use EDR tools to detect unauthorized file writes by the `ignition` service account.
## References
- **Vendor Advisory:** hxxps[://]inductiveautomation[.]com/blog/inductive-automation-security-advisory-ignition-8144
- **CISA Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-24-246-06
- **Cyber Centre Alert:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/control-systems-inductive-automation-security-advisory-av26-892