CVE-2023-25005
📋 TL;DR
This vulnerability in Autodesk InfraWorks allows attackers to craft malicious DLL files that cause the software to read beyond allocated memory boundaries. This could lead to resource injection attacks, potentially allowing arbitrary code execution. Users of Autodesk InfraWorks 2023 and 2021 are affected.
💻 Affected Systems
- Autodesk InfraWorks
📦 What is this software?
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the InfraWorks process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited information disclosure through memory reading.
If Mitigated
Application crash with no data loss if proper sandboxing and privilege separation are implemented.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious DLL file. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version as specified in Autodesk advisory
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0006
Restart Required: Yes
Instructions:
1. Open Autodesk Desktop App or Autodesk Account. 2. Check for available updates. 3. Install the security update for InfraWorks. 4. Restart the application and any related services.
🔧 Temporary Workarounds
Restrict DLL loading
windowsUse application control policies to restrict loading of untrusted DLLs
Configure Windows AppLocker or similar application control solution
User awareness training
allTrain users not to open untrusted DLL files with InfraWorks
🧯 If You Can't Patch
- Restrict user permissions to minimize impact if exploited
- Implement network segmentation to isolate InfraWork installations
🔍 How to Verify
Check if Vulnerable:
Check InfraWorks version in Help > About. If version is 2023 or 2021 without latest security patches, it is vulnerable.Check Version:
In InfraWorks: Help > About or check Windows Programs and FeaturesVerify Fix Applied:
Verify version number matches patched version in Autodesk advisory and test with sample DLL files.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected DLL loading events
Network Indicators:
- Unusual outbound connections from InfraWorks process
SIEM Query:
EventID=1000 OR EventID=1001 with process name containing 'InfraWorks'