CVE-2020-28598
📋 TL;DR
This vulnerability allows remote code execution through a specially crafted AMF file in PrusaSlicer. Attackers can exploit an out-of-bounds write in the stl_fix_normal_directions() function to execute arbitrary code. Users of PrusaSlicer 2.2.0 and development versions are affected.
💻 Affected Systems
- Prusa Research PrusaSlicer
📦 What is this software?
Prusaslicer by Prusa3d
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's computer, potentially leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the PrusaSlicer user, allowing file system access, data exfiltration, or installation of malware.
If Mitigated
Limited impact with proper file validation and sandboxing, potentially only causing application crashes or denial of service.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious AMF file. The vulnerability is well-documented with technical details available in the Talos Intelligence report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0 and later
Vendor Advisory: https://github.com/prusa3d/PrusaSlicer/releases
Restart Required: Yes
Instructions:
1. Download latest version from official PrusaSlicer website or GitHub. 2. Uninstall old version. 3. Install new version. 4. Restart computer.
🔧 Temporary Workarounds
Disable AMF file processing
allPrevent PrusaSlicer from opening AMF files by modifying file associations
Windows: assoc .amf=
Linux: Remove .amf from mimeapps.list
macOS: Remove .amf from Launch Services
Sandbox execution
allRun PrusaSlicer in a restricted environment
Windows: RunAs /netonly
Linux: firejail prusa-slicer
macOS: sandbox-exec -n no-network prusa-slicer
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted AMF files
- Use application whitelisting to restrict PrusaSlicer execution to trusted directories only
🔍 How to Verify
Check if Vulnerable:
Check PrusaSlicer version in Help > About menu or run 'prusa-slicer --version' in terminalCheck Version:
prusa-slicer --versionVerify Fix Applied:
Verify version is 2.3.0 or higher and test opening known safe AMF files📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected child processes spawned from PrusaSlicer
- AMF file processing errors
Network Indicators:
- Outbound connections from PrusaSlicer to unexpected destinations
- DNS requests for suspicious domains after file processing
SIEM Query:
process_name:"prusa-slicer.exe" AND (event_id:1000 OR event_id:1001) OR file_extension:".amf" AND process_name:"prusa-slicer.exe"