CVE-2023-39475: 
NixOS vulnerability analysis and mitigation

Inductive Automation Ignition contains a critical deserialization vulnerability (CVE-2023-39475) affecting versions 8.1.22 to 8.1.24. The vulnerability was discovered in March 2023 and publicly disclosed on August 8, 2023. This flaw exists within the ParameterVersionJavaSerializationCodec class and has been assigned a CVSS score of 9.8, indicating its critical severity (ZDI Advisory, Security Online).

The vulnerability stems from the lack of proper validation of user-supplied data in the ParameterVersionJavaSerializationCodec class, which can result in deserialization of untrusted data. The flaw specifically exists within the decode methods where input validation is insufficient. This vulnerability has received the highest severity rating with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating its critical nature and ease of exploitation (ZDI Advisory).

The exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected installations with SYSTEM-level privileges. This means attackers can gain complete control over the affected system, potentially leading to system compromise, data theft, and unauthorized control of the SCADA environment (Security Online, ZDI Advisory).

The vulnerability requires no authentication to exploit, making it particularly dangerous. The proof-of-concept exploit has been developed and demonstrated using an RCE gadget, confirming the vulnerability's exploitability in real-world scenarios (Security Online).

The primary mitigation strategy is to restrict interaction with the application and update to the latest version of Ignition. Inductive Automation has acknowledged the vulnerability and recommends users of version 8.1.24 and below to update their installations immediately to protect against potential exploitation (ZDI Advisory, Security Online).