Inductive Automation Ignition Gateway Blank Default Create Project Role Privilege Escalation

#!/usr/bin/env bash
# CVE-2026-77393 Checker for Inductive Automation Ignition
# Checks: (1) Ignition version <= 8.1.53, (2) blank Create Project Role(s)
# Usage: bash check_cve_2026_77393.sh /path/to/ignition
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

IGN_HOME="${1:-/usr/local/bin/ignition}"
GATEWAY_XML="${IGN_HOME}/data/gateway.xml"

if [ ! -d "$IGN_HOME" ]; then
  echo "UNKNOWN — Ignition install directory not found at $IGN_HOME"
  exit 2
fi

# Check version
VERSION_FILE="${IGN_HOME}/.ignition-version"
if [ -f "$VERSION_FILE" ]; then
  VERSION=$(cat "$VERSION_FILE" | tr -d '[:space:]')
else
  # Try gateway.xml for version info
  VERSION=$(grep -oP 'version="\K[^"]+' "$GATEWAY_XML" 2>/dev/null | head -1 || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine Ignition version"
  exit 2
fi

echo "Detected Ignition version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check if version is in the affected range (8.1.x where x <= 53)
if [ "$MAJOR" -eq 8 ] && [ "$MINOR" -eq 1 ]; then
  if [ "${PATCH:-0}" -le 53 ]; then
    echo "Version $VERSION is in the affected range (<=8.1.53)"
    # Check if Create Project Role(s) is blank
    if [ -f "$GATEWAY_XML" ]; then
      # Look for the createProjectRoles setting
      ROLE_SETTING=$(grep -i 'createprojectrole' "$GATEWAY_XML" 2>/dev/null || echo "")
      if [ -z "$ROLE_SETTING" ] || echo "$ROLE_SETTING" | grep -qP 'value="\s*"'; then
        echo "VULNERABLE — Ignition $VERSION with blank Create Project Role(s) setting"
        echo "CVE-2026-77393: Default permissions allow any authenticated user to create projects"
        echo "FIX: Set Create Project Role(s) to your Designer Role, or upgrade to 8.1.54+"
        exit 1
      else
        echo "PATCHED — Version is affected but Create Project Role(s) has been configured"
        echo "Workaround is in place. Consider upgrading to 8.1.54+ for a permanent fix."
        exit 0
      fi
    else
      echo "UNKNOWN — could not read gateway.xml at $GATEWAY_XML"
      exit 2
    fi
  else
    echo "PATCHED — Ignition $VERSION is 8.1.54 or later"
    exit 0
  fi
elif [ "$MAJOR" -eq 8 ] && [ "$MINOR" -ge 3 ]; then
  echo "PATCHED — Ignition 8.3+ is not affected by CVE-2026-77393"
  exit 0
else
  echo "UNKNOWN — unexpected version $VERSION; manual review recommended"
  exit 2
fi