CVE-2024-3468 Overview
CVE-2024-3468 is a deserialization vulnerability [CWE-502] in AVEVA PI Web API. Attackers can execute malicious code within the PI Web API environment when an interactive user is socially engineered into importing attacker-supplied XML content through the API import functionality. The code executes under the privileges of the affected interactive user, giving attackers a foothold in industrial control environments that expose PI System data through the Web API.
Critical Impact
Successful exploitation grants arbitrary code execution on the PI Web API host under the compromised user's privileges, exposing operational technology (OT) data flows and connected PI System components.
Affected Products
- AVEVA PI Web API (specific affected versions listed in the CISA ICS Advisory ICSA-24-163-02)
Discovery Timeline
- 2024-06-12 - CVE-2024-3468 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3468
Vulnerability Analysis
The flaw resides in the XML import functionality exposed by AVEVA PI Web API. The API accepts XML content and deserializes it without adequately validating the resulting object types. When an interactive user imports attacker-controlled XML, the deserializer instantiates objects defined in the payload and invokes methods during reconstruction. This behavior converts a data import operation into arbitrary code execution inside the PI Web API process.
Because the PI Web API bridges the PI Data Archive and Asset Framework with external clients, code execution in this environment can pivot into broader OT data infrastructure. The attacker does not need administrative access on the target system; the exploit inherits the privileges of the user tricked into performing the import.
Root Cause
The root cause is unsafe deserialization of untrusted XML input [CWE-502]. The import routine does not restrict the set of types that can be materialized from XML, allowing gadget chains to trigger unintended method execution during object graph reconstruction.
Attack Vector
Exploitation requires network access to the PI Web API and user interaction. The attacker crafts an XML document containing serialized objects designed to execute code when deserialized, then convinces an authenticated interactive user to submit the file through the API's import feature. No additional privilege escalation is needed for the initial payload to run under the victim's context.
No verified public exploit code or proof-of-concept is available. See the CISA ICS Advisory ICSA-24-163-02 for vendor and CISA-issued technical details.
Detection Methods for CVE-2024-3468
Indicators of Compromise
- Unexpected child processes spawned by the PI Web API service process or by interactive user sessions that recently invoked XML import operations.
- XML payloads submitted to PI Web API import endpoints containing serialized .NET type references or gadget-chain markers such as ObjectDataProvider, MethodName, or unusual assembly names.
- Outbound network connections from the PI Web API host to unknown external hosts shortly after an XML import event.
Detection Strategies
- Inspect PI Web API request logs for XML uploads to import endpoints and correlate with process creation events on the host.
- Alert on script interpreters (powershell.exe, cmd.exe, wscript.exe) or shells launched as children of PI Web API worker processes.
- Deploy behavioral endpoint detection to identify deserialization gadget behavior such as reflective assembly loading or unexpected System.Diagnostics.Process invocations from the PI Web API context.
Monitoring Recommendations
- Baseline normal PI Web API import volume and content types, then alert on deviations.
- Forward Windows Security, Sysmon, and PI Web API application logs to a centralized SIEM for cross-correlation with identity and network telemetry.
- Monitor accounts authorized to perform XML imports and flag imports originating from user workstations that do not normally touch the API.
How to Mitigate CVE-2024-3468
Immediate Actions Required
- Apply the AVEVA-provided patch for PI Web API as directed in the CISA ICS Advisory ICSA-24-163-02.
- Restrict which accounts are authorized to invoke XML import functionality and remove this permission from accounts that do not require it.
- Train interactive PI Web API users to reject XML files received from untrusted or unverified sources.
Patch Information
AVEVA has released updated PI Web API versions addressing the deserialization defect. Consult the vendor advisory referenced in the CISA ICS Advisory ICSA-24-163-02 for the specific fixed versions and upgrade guidance.
Workarounds
- Segment PI Web API hosts on isolated OT network zones and block direct internet exposure.
- Enforce least-privilege on the interactive accounts used with PI Web API to limit the blast radius of code execution.
- Require multi-factor authentication and endpoint controls on workstations that interact with PI Web API import endpoints.
- Inspect and sanitize XML documents at a gateway or proxy before they reach the PI Web API where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
