CVE-2022-27873
📋 TL;DR
This vulnerability in Autodesk Fusion 360 allows attackers to force victims' devices to make arbitrary HTTP requests through malicious SVG files. Attackers can also obtain victims' public IP addresses and potentially other sensitive information. Users of affected Autodesk Fusion 360 versions are at risk.
💻 Affected Systems
- Autodesk Fusion 360
📦 What is this software?
Fusion 360 by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control over victim's network traffic, exfiltrates sensitive data, and uses victim's device as proxy for attacks on internal systems.
Likely Case
Attacker obtains victim's public IP address and forces device to make unwanted HTTP requests, potentially revealing network information.
If Mitigated
Limited information disclosure with no significant impact due to network segmentation and proper security controls.
🎯 Exploit Status
Exploitation requires user interaction to open malicious SVG file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.15015 and later
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0013
Restart Required: Yes
Instructions:
1. Open Autodesk Fusion 360. 2. Go to Help menu. 3. Select 'Check for Updates'. 4. Install version 2.0.15015 or later. 5. Restart the application.
🔧 Temporary Workarounds
Disable SVG Insertion
allPrevent users from inserting SVG files into Fusion 360 documents
Network Segmentation
allRestrict Fusion 360 network access to prevent external HTTP requests
🧯 If You Can't Patch
- Educate users to never open SVG files from untrusted sources
- Implement application whitelisting to restrict SVG file execution
🔍 How to Verify
Check if Vulnerable:
Check Fusion 360 version in Help > About. If version is below 2.0.15015, system is vulnerable.Check Version:
Not applicable - check through application GUIVerify Fix Applied:
Confirm version is 2.0.15015 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Fusion 360 process
- Multiple SVG file parsing errors
Network Indicators:
- Unexpected HTTP traffic from Fusion 360 to external domains
- SVG file downloads followed by outbound requests
SIEM Query:
process_name='Fusion360.exe' AND (destination_port=80 OR destination_port=443) AND NOT destination_ip IN [allowed_domains]