CVE-2020-28596
📋 TL;DR
A stack-based buffer overflow vulnerability in PrusaSlicer's OBJ file parser allows remote code execution when processing malicious 3D model files. Users who open untrusted OBJ files with vulnerable versions are affected. This could lead to complete system compromise.
💻 Affected Systems
- Prusa Research PrusaSlicer
📦 What is this software?
Prusaslicer by Prusa3d
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the PrusaSlicer user, potentially leading to ransomware deployment, data theft, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise, file system access, and potential lateral movement within the network.
If Mitigated
Limited impact with application crash or denial of service if exploit fails or is blocked by security controls.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. Proof of concept available in Talos advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0 and later
Vendor Advisory: https://github.com/prusa3d/PrusaSlicer/releases
Restart Required: Yes
Instructions:
1. Download latest version from official PrusaSlicer website or GitHub. 2. Uninstall old version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Disable OBJ file processing
allPrevent PrusaSlicer from opening OBJ files by removing file association
On Windows: assoc .obj=
On Linux: Remove .obj from PrusaSlicer's mime associations
Run with reduced privileges
allRun PrusaSlicer as limited user account without admin rights
🧯 If You Can't Patch
- Only open OBJ files from trusted sources
- Use application sandboxing or containerization to isolate PrusaSlicer
🔍 How to Verify
Check if Vulnerable:
Check PrusaSlicer version in Help > About. If version is 2.2.0 or earlier, you are vulnerable.Check Version:
On Windows: PrusaSlicer.exe --version
On Linux: ./prusa-slicer --versionVerify Fix Applied:
Verify version is 2.3.0 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening OBJ files
- Unusual process spawning from PrusaSlicer
Network Indicators:
- Outbound connections from PrusaSlicer to unknown IPs
SIEM Query:
Process:PrusaSlicer AND (EventID:1000 OR ParentProcess:PrusaSlicer)