CVE-2021-27494
📋 TL;DR
This vulnerability allows remote code execution through specially crafted STP files in KeyShot's 3D file parsing modules. Attackers can exploit stack-based buffer overflows to execute arbitrary code with the privileges of the current process. Users of KeyShot versions v10.1 and earlier are affected.
💻 Affected Systems
- KeyShot
📦 What is this software?
Keyshot by Luxion
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or remote code execution when users open malicious STP files, potentially leading to malware installation or data exfiltration.
If Mitigated
Limited impact with proper network segmentation, application sandboxing, and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious STP file. ZDI advisory suggests exploit development is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: KeyShot v10.2 or later
Vendor Advisory: https://www.keyshot.com/support/
Restart Required: Yes
Instructions:
1. Download KeyShot v10.2 or later from official website. 2. Install the update following vendor instructions. 3. Restart the application and system if prompted.
🔧 Temporary Workarounds
Restrict STP file handling
allBlock or restrict processing of STP files through application controls or file type restrictions.
Application sandboxing
allRun KeyShot in restricted environments or sandboxes to limit potential damage from exploitation.
🧯 If You Can't Patch
- Implement strict file validation for STP files before opening in KeyShot
- Use network segmentation to isolate KeyShot systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check KeyShot version in Help > About menu. If version is 10.1 or earlier, system is vulnerable.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Luxion\KeyShot\Version. On macOS/Linux: Check application info or package manager.Verify Fix Applied:
Verify version is 10.2 or later in Help > About menu after update installation.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening STP files
- Unusual process spawning from KeyShot
- Memory access violation errors
Network Indicators:
- Unexpected outbound connections from KeyShot process
- File downloads to KeyShot directory
SIEM Query:
Process creation where parent_process contains 'KeyShot' AND (process contains 'cmd.exe' OR process contains 'powershell.exe' OR process contains 'bash')🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
- https://www.zerodayinitiative.com/advisories/ZDI-21-564/
- https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
- https://www.zerodayinitiative.com/advisories/ZDI-21-564/
