CVE-2023-41139
📋 TL;DR
A maliciously crafted STP file can trigger an untrusted pointer dereference vulnerability in Autodesk AutoCAD 2024 and 2023. This could allow an attacker to execute arbitrary code in the context of the current AutoCAD process. Users who open untrusted STP files with affected AutoCAD versions are at risk.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the AutoCAD user, potentially leading to system compromise, data theft, or lateral movement.
Likely Case
Application crash (denial of service) or limited code execution within AutoCAD's process context.
If Mitigated
No impact if untrusted STP files are not opened or if the patch is applied.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious STP file; no public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2023-0018 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
Restart Required: Yes
Instructions:
1. Open Autodesk Desktop App or AutoCAD. 2. Check for updates. 3. Install the latest security update from Autodesk. 4. Restart AutoCAD after installation.
🔧 Temporary Workarounds
Block STP file extensions
windowsPrevent AutoCAD from opening .stp files via group policy or application settings.
User awareness training
allEducate users not to open STP files from untrusted sources.
🧯 If You Can't Patch
- Restrict user permissions to limit damage from potential code execution.
- Use application whitelisting to prevent unauthorized executables from running.
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against affected versions (2024, 2023) in the vendor advisory.Check Version:
In AutoCAD, go to Help > About or type 'ABOUT' in command line.Verify Fix Applied:
Verify AutoCAD version is updated to a patched version listed in Autodesk Security Advisory ADSK-SA-2023-0018.📡 Detection & Monitoring
Log Indicators:
- Application crashes in AutoCAD when opening STP files
- Unusual process creation from AutoCAD
Network Indicators:
- Downloads of STP files from untrusted sources
SIEM Query:
EventID=1000 (Application Error) with AutoCAD in Source or Process Name