CVE-2023-34305
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ashlar-Vellum Cobalt installations by tricking users into opening malicious X_B or X_T files. The flaw is an out-of-bounds write due to improper input validation during file parsing. Affected users include anyone using vulnerable versions of Ashlar-Vellum Cobalt software.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution with current user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Attacker gains code execution in the context of the current user, enabling data access, privilege escalation, or persistence mechanisms.
If Mitigated
Limited impact if proper application sandboxing, least privilege, and file validation controls are in place.
🎯 Exploit Status
Exploitation requires social engineering to deliver malicious file; no authentication needed once file is opened
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-865/
Restart Required: Yes
Instructions:
1. Check Ashlar-Vellum website for security updates
2. Download and install latest version
3. Restart system after installation
🔧 Temporary Workarounds
Block X_B and X_T file extensions
allPrevent opening of potentially malicious files via email filters or endpoint protection
User awareness training
allEducate users about risks of opening untrusted CAD files
🧯 If You Can't Patch
- Run application with restricted privileges using least privilege principles
- Implement application whitelisting to prevent unauthorized execution
🔍 How to Verify
Check if Vulnerable:
Check Ashlar-Vellum Cobalt version against vendor's patched version listCheck Version:
Check Help > About in Ashlar-Vellum Cobalt applicationVerify Fix Applied:
Verify installed version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of Ashlar-Vellum Cobalt
- Unusual file access patterns for X_B/X_T files
Network Indicators:
- Downloads of X_B/X_T files from untrusted sources
SIEM Query:
Process:asahlar-vellum AND (FileExtension:X_B OR FileExtension:X_T) FROM suspicious_source