CVE-2023-38121: 
NixOS vulnerability analysis and mitigation

CVE-2023-38121 is a Cross-Site Scripting (XSS) Remote Code Execution vulnerability affecting Inductive Automation Ignition OPC UA Quick Client. The vulnerability was discovered during the Pwn2Own Miami competition and disclosed in May 2024. The vulnerability affects installations of Inductive Automation Ignition, specifically within the web interface (ZDI Advisory, Inductive Blog).

The vulnerability exists within the handling of the id parameter provided to the Inductive Automation Ignition web interface. The issue stems from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary scripts. The vulnerability has been assigned a CVSS v3.0 base score of 8.3 (HIGH) with the vector string: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of SYSTEM on affected installations. The attack requires user interaction, specifically that the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation, where the target must visit a malicious page or open a malicious file. While authentication is not required to exploit this vulnerability, the attack vector is network-based and requires high attack complexity (ZDI Advisory).

Inductive Automation has issued an update to correct this vulnerability. The fix was included in Ignition version 8.1.26, which was released on March 21st. Users are recommended to stay up-to-date with the latest version of Ignition (Inductive Blog).

The vulnerability was discovered during the Pwn2Own Miami competition, where Inductive Automation actively participated. The company was commended by ZDI for having the fastest response to the vulnerabilities found during the competition. The discovery was part of their proactive security approach, with the company offering $125,000 in prize money for finding vulnerabilities in Ignition (Inductive Blog).