CVE-2023-2762
📋 TL;DR
A use-after-free vulnerability in SOLIDWORKS Desktop allows attackers to execute arbitrary code when users open malicious SLDPRT files. This affects SOLIDWORKS 2021 through 2023 releases. Users who open untrusted SLDPRT files are at risk of complete system compromise.
💻 Affected Systems
- SOLIDWORKS Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to installation of malware, data exfiltration, or persistence mechanisms on the compromised system.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially resulting in application crash rather than code execution.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SOLIDWORKS Service Packs for 2021-2023 releases
Vendor Advisory: https://www.3ds.com/vulnerability/advisories
Restart Required: Yes
Instructions:
1. Check SOLIDWORKS version. 2. Download and install latest Service Pack from SOLIDWORKS Customer Portal. 3. Restart system. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict SLDPRT file handling
windowsBlock or restrict opening of SLDPRT files from untrusted sources
Application sandboxing
windowsRun SOLIDWORKS in restricted environment or virtual machine
🧯 If You Can't Patch
- Implement strict file handling policies to block SLDPRT files from untrusted sources
- Run SOLIDWORKS with minimal user privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check SOLIDWORKS version in Help > About SOLIDWORKS. If version is between 2021 and 2023, system is vulnerable.Check Version:
In SOLIDWORKS: Help > About SOLIDWORKSVerify Fix Applied:
Verify installed Service Pack version in Help > About SOLIDWORKS matches latest available version from vendor.📡 Detection & Monitoring
Log Indicators:
- SOLIDWORKS crash logs with memory access violations
- Unexpected process creation from SOLIDWORKS
Network Indicators:
- Outbound connections from SOLIDWORKS process to suspicious IPs
SIEM Query:
Process creation where parent_process contains 'sldworks.exe' AND process_name NOT IN (expected_child_processes)