CVE-2023-41032
📋 TL;DR
This vulnerability allows remote code execution through specially crafted X_T files in Parasolid and Simcenter Femap software. An attacker could execute arbitrary code in the context of the current process by exploiting an out-of-bounds write vulnerability. Users of affected Parasolid and Simcenter Femap versions are at risk.
💻 Affected Systems
- Parasolid
- Simcenter Femap
📦 What is this software?
Parasolid by Siemens
Parasolid by Siemens
Parasolid by Siemens
Parasolid by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the application process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or remote code execution when processing malicious X_T files, potentially compromising engineering data and systems.
If Mitigated
Limited impact with proper file validation and least privilege controls, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires crafting a malicious X_T file that triggers the out-of-bounds write. No authentication is needed if the application processes the file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parasolid V34.1.258, V35.0.253, V35.1.184, V36.0.142; Simcenter Femap V2301.0003, V2306.0001
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf
Restart Required: Yes
Instructions:
1. Download the latest version from Siemens or Bentley official sources. 2. Backup current installation and data. 3. Run the installer with administrative privileges. 4. Restart the system after installation completes.
🔧 Temporary Workarounds
Restrict X_T file processing
allImplement application control to block processing of untrusted X_T files or restrict file sources.
Run with reduced privileges
windowsConfigure the application to run with limited user privileges to reduce impact of successful exploitation.
🧯 If You Can't Patch
- Implement strict file validation: Only allow X_T files from trusted sources and scan all incoming files.
- Network segmentation: Isolate systems running vulnerable software from critical networks and internet access.
🔍 How to Verify
Check if Vulnerable:
Check the installed version against affected version ranges in the application's about dialog or installation details.Check Version:
Windows: Check 'Programs and Features' or application Help > About; Linux: Check package manager or application version commandVerify Fix Applied:
Verify the installed version matches or exceeds the patched versions listed in the vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing X_T files
- Unexpected process creation from Parasolid/Femap processes
- File parsing errors in application logs
Network Indicators:
- Unusual outbound connections from engineering workstations
- File transfers of X_T files from untrusted sources
SIEM Query:
Process creation where parent process contains 'parasolid' or 'femap' AND (command line contains '.x_t' OR file extension is '.x_t')🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf
- https://www.bentley.com/advisories/be-2023-0004/
- https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf
- https://www.bentley.com/advisories/be-2023-0004/
