CVE-2023-35712
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ashlar-Vellum Cobalt installations by tricking users into opening malicious XE files or visiting malicious web pages. The flaw exists in uninitialized memory handling during XE file parsing, enabling code execution in the current process context. Users of Ashlar-Vellum Cobalt software are affected.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious code execution with user privileges, potentially leading to data exfiltration, lateral movement, or additional payload deployment.
If Mitigated
Limited impact through application sandboxing or restricted user privileges, though still potentially allowing local privilege escalation.
🎯 Exploit Status
Requires user interaction; exploit likely involves crafted XE files
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-875/
Restart Required: Yes
Instructions:
1. Contact Ashlar-Vellum for patch availability
2. Apply latest software updates
3. Restart affected systems
🔧 Temporary Workarounds
Restrict XE file handling
allBlock or restrict opening of XE files through application controls or group policy
User awareness training
allTrain users to avoid opening untrusted XE files or visiting suspicious websites
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized executables
- Run Cobalt with restricted user privileges (non-admin)
🔍 How to Verify
Check if Vulnerable:
Check Cobalt version against vendor patch information; test with known safe XE file parsingCheck Version:
Check application 'About' menu or installation detailsVerify Fix Applied:
Verify patch installation through version check and test XE file parsing functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes from Cobalt
- Suspicious child processes spawned from Cobalt
Network Indicators:
- Outbound connections from Cobalt to unknown destinations
- Unusual network traffic patterns following XE file access
SIEM Query:
Process creation where parent process contains 'cobalt' AND (command line contains '.xe' OR network connection to suspicious IP)