CVE-2021-27488
📋 TL;DR
This vulnerability allows remote code execution through specially crafted CATPart files in KeyShot 3D rendering software. An attacker can exploit improper validation in multiple 3D file reading modules to write past allocated memory boundaries and execute arbitrary code. Users of KeyShot versions v10.1 and prior who process untrusted CATPart files are affected.
💻 Affected Systems
- KeyShot
📦 What is this software?
Keyshot by Luxion
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the KeyShot process, potentially leading to lateral movement, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or remote code execution when users open malicious CATPart files, potentially leading to malware installation or data exfiltration.
If Mitigated
Limited impact with proper file validation and user privilege restrictions, potentially causing application crashes but no code execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious CATPart files. The vulnerability is an out-of-bounds write that can lead to arbitrary code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: KeyShot v10.2 and later
Vendor Advisory: https://www.keyshot.com/support/
Restart Required: Yes
Instructions:
1. Download KeyShot v10.2 or later from the official website. 2. Run the installer and follow on-screen instructions. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Restrict CATPart file processing
allBlock or restrict processing of CATPart files through application controls or file type restrictions.
Run with reduced privileges
windowsConfigure KeyShot to run with limited user privileges to reduce impact of successful exploitation.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use network segmentation to isolate systems running vulnerable KeyShot versions
🔍 How to Verify
Check if Vulnerable:
Check KeyShot version in Help > About menu. If version is 10.1 or earlier, the system is vulnerable.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Luxion\KeyShot\Version or check Help > About in applicationVerify Fix Applied:
Verify KeyShot version is 10.2 or later in Help > About menu and test with known safe CATPart files.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing CATPart files
- Unusual process creation from KeyShot executable
Network Indicators:
- Unexpected outbound connections from KeyShot process
- File downloads triggered by KeyShot
SIEM Query:
Process Creation where ParentImage contains 'keyshot.exe' AND NOT (Image contains expected_child_processes)🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
- https://www.zerodayinitiative.com/advisories/ZDI-21-563/
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
- https://www.zerodayinitiative.com/advisories/ZDI-21-563/
