CVE-2022-27872
📋 TL;DR
This vulnerability in Autodesk Navisworks 2022 allows attackers to craft malicious PDF files that cause pointer dereference issues during parsing, potentially leading to crashes, sensitive data exposure, or arbitrary code execution. Users of Autodesk Navisworks 2022 who open untrusted PDF files are affected.
💻 Affected Systems
- Autodesk Navisworks
📦 What is this software?
Navisworks by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to complete system compromise
Likely Case
Application crash or denial of service with potential information disclosure
If Mitigated
Limited impact with proper patching and user awareness about opening untrusted files
🎯 Exploit Status
Exploitation requires user interaction to open malicious PDF; no public exploit code available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.2.1 or later
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011
Restart Required: Yes
Instructions:
1. Open Autodesk Navisworks 2022. 2. Navigate to Help > About. 3. Check version is 2022.2.1 or higher. 4. If not, download and install the latest update from Autodesk Account portal or through the Autodesk Desktop App.
🔧 Temporary Workarounds
Restrict PDF file handling
windowsConfigure Navisworks to not automatically open PDF files or restrict PDF file handling through external applications
User awareness training
allTrain users to only open PDF files from trusted sources and verify file integrity
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of malicious code
- Use network segmentation to isolate Navisworks systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check Navisworks version: Open Navisworks > Help > About. If version is earlier than 2022.2.1, system is vulnerable.Check Version:
Not applicable - check through GUI Help > About menuVerify Fix Applied:
Verify version is 2022.2.1 or later in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Application crash logs from Navisworks
- Windows Event Logs showing application failures
Network Indicators:
- Unusual PDF file transfers to Navisworks users
- Outbound connections from Navisworks process post-PDF opening
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="*navisworks*" AND ExceptionCode="0xc0000005"