Collected research
CVE-2023–50220 — Inductive Automation Ignition XML Deserialization to RCE
Ignition's /data/status/store_forward_import/<store> route accepts a multipart XML file. An element <data flavor="__datasourcedata__" subtype=""> makes QuarantinedXmlImporter pick HistoryFlavor's Base64XmlReader, which base64-decodes the <base64> child and hands it to ObjectInputStream.readObject. No stock ysoserial chain fit, so the author built one from Jython, swapping PyFunction for PyMethod as the proxy InvocationHandler to reach __builtin__.eval and run OS commands.
Record
- Researcher
- Petrus Viet and @VietPetrus
- Published by
- Medium
- Date
- Format
- Advisory
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Petrus Viet and @VietPetrus, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .