CVE-2023-23579
📋 TL;DR
This vulnerability in Datakit CrossCadWare_x64.dll allows remote code execution through an out-of-bounds write when parsing malicious SLDPRT files. Attackers can execute arbitrary code in the context of the current process. Users of software incorporating this vulnerable DLL are affected.
💻 Affected Systems
- Software using Datakit CrossCadWare_x64.dll for SLDPRT file parsing
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or application compromise when users open malicious SLDPRT files, potentially leading to malware installation.
If Mitigated
Limited impact with proper application sandboxing, file validation, and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious SLDPRT files. No public exploit code identified in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with software vendors using the vulnerable DLL
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
Restart Required: Yes
Instructions:
1. Identify software using Datakit CrossCadWare_x64.dll
2. Contact software vendor for patch availability
3. Apply vendor-provided updates
4. Restart affected applications/services
🔧 Temporary Workarounds
File Type Restriction
windowsBlock or restrict SLDPRT file processing in vulnerable applications
Application Sandboxing
windowsRun vulnerable applications with reduced privileges or in isolated environments
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized execution
- Use email/web gateways to block SLDPRT attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check if applications use CrossCadWare_x64.dll and process SLDPRT files. Review vendor security advisories.Check Version:
Get-Item "path\to\CrossCadWare_x64.dll" | Select-Object VersionInfoVerify Fix Applied:
Verify DLL version after patch application. Test with known safe SLDPRT files.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing SLDPRT files
- Unexpected process spawning from CAD applications
Network Indicators:
- Unusual outbound connections from CAD software
- SLDPRT file downloads from untrusted sources
SIEM Query:
Process creation where parent process contains "cad" or "solidworks" AND command line contains ".sldprt"