CVE-2023-29075
📋 TL;DR
This vulnerability allows attackers to exploit a memory corruption flaw in Autodesk AutoCAD by tricking users into opening malicious PRT files. Successful exploitation could lead to arbitrary code execution, data theft, or application crashes, affecting users of AutoCAD 2023 and 2024.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution with the privileges of the current user, potentially leading to full system compromise.
Likely Case
Application crash or denial of service, with possible data leakage in targeted attacks.
If Mitigated
Limited impact if patches are applied or workarounds prevent PRT file execution.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file, but crafting such files may be complex.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to the latest version as specified in Autodesk advisory ADSK-SA-2023-0018.
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
Restart Required: Yes
Instructions:
1. Open AutoCAD. 2. Go to Help > Check for Updates. 3. Follow prompts to install the latest update. 4. Restart AutoCAD as required.
🔧 Temporary Workarounds
Block PRT file execution
windowsPrevent AutoCAD from opening PRT files by adjusting file associations or using application controls.
Use Windows Group Policy or similar tools to restrict .prt file handling in AutoCAD.
🧯 If You Can't Patch
- Restrict user permissions to limit the impact of potential code execution.
- Implement network segmentation and monitoring to detect suspicious file activities.
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version; if it is 2023 or 2024 and not updated per the advisory, it is vulnerable.Check Version:
In AutoCAD, go to Help > About AutoCAD to view the version number.Verify Fix Applied:
Verify that AutoCAD version is updated to a patched release as listed in the Autodesk advisory.📡 Detection & Monitoring
Log Indicators:
- Log entries showing AutoCAD crashes or errors when opening PRT files.
Network Indicators:
- Unusual network traffic from AutoCAD processes post-file opening.
SIEM Query:
Example: 'source="AutoCAD" AND (event="crash" OR event="error") AND file_extension=".prt"'