CVE-2023-34291
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ashlar-Vellum Cobalt installations by tricking users into opening malicious X_B or X_T files. The flaw is an out-of-bounds write due to improper input validation when parsing these file formats. Users of Ashlar-Vellum Cobalt CAD software are affected.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware execution in user context, potentially leading to data exfiltration or persistence mechanisms.
If Mitigated
Limited impact if user runs with minimal privileges, application sandboxed, or file execution blocked.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability was discovered by Zero Day Initiative (ZDI-CAN-18401).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-829/
Restart Required: Yes
Instructions:
1. Check Ashlar-Vellum website for security updates. 2. Download and install latest version. 3. Restart system to ensure patch is fully applied.
🔧 Temporary Workarounds
Block X_B and X_T file extensions
windowsPrevent execution of potentially malicious X_B and X_T files through group policy or application controls.
User awareness training
allTrain users not to open CAD files from untrusted sources.
🧯 If You Can't Patch
- Run Cobalt with minimal user privileges (not as administrator)
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Ashlar-Vellum Cobalt version against vendor's patched version list. If using unpatched version, assume vulnerable.Check Version:
Launch Cobalt and check Help > About or similar menu for version informationVerify Fix Applied:
Verify installed version matches or exceeds vendor's patched version. Test with known safe X_B/X_T files to ensure proper parsing.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of Cobalt.exe
- Unusual file access patterns to X_B/X_T files
- Suspicious child processes spawned from Cobalt
Network Indicators:
- Unexpected outbound connections from Cobalt process
- File downloads of X_B/X_T files from untrusted sources
SIEM Query:
Process creation where parent_process_name contains 'Cobalt' and (process_name not in approved_list)