CVE-2023-29073
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or read sensitive data by tricking users into opening malicious MODEL files in AutoCAD. It affects AutoCAD 2024 and 2023 users who open untrusted files. The heap-based buffer overflow can lead to complete system compromise.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the AutoCAD process, potentially leading to lateral movement, data exfiltration, or ransomware deployment.
Likely Case
Arbitrary code execution in AutoCAD context, allowing attackers to steal sensitive design files, install malware, or pivot to other systems.
If Mitigated
Limited impact with proper patching and user training, potentially just application crashes if exploit fails.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. No public exploit code available at time of advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update through Autodesk Desktop App or download from Autodesk Account
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
Restart Required: Yes
Instructions:
1. Open Autodesk Desktop App. 2. Check for updates. 3. Install available AutoCAD updates. 4. Restart AutoCAD after installation.
🔧 Temporary Workarounds
Block MODEL file extensions
windowsPrevent AutoCAD from opening .model files via group policy or application restrictions
User training and file restrictions
allTrain users to only open trusted files and implement file type restrictions
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized AutoCAD execution
- Use network segmentation to isolate AutoCAD workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version: 2024 or 2023 versions are vulnerable. Verify by opening AutoCAD and checking Help > About.Check Version:
In AutoCAD command line: (getvar "acadver") or check Help > About dialogVerify Fix Applied:
After update, verify version is no longer 2024 or 2023 original release. Check for latest updates in Autodesk Desktop App.📡 Detection & Monitoring
Log Indicators:
- AutoCAD crashes with heap corruption errors
- Unexpected MODEL file access attempts
- Process creation from AutoCAD context
Network Indicators:
- Downloads of MODEL files from untrusted sources
- Outbound connections from AutoCAD process
SIEM Query:
EventID=1000 OR EventID=1001 Source=AutoCAD.exe AND (Keywords="heap" OR "buffer")