CVE-2023-42103
📋 TL;DR
This is a use-after-free vulnerability in Ashlar-Vellum Cobalt's AR file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious AR files or visiting malicious web pages. Users of Ashlar-Vellum Cobalt software are affected.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the affected workstation, potentially leading to data exfiltration or persistence establishment.
If Mitigated
Limited impact due to application sandboxing, limited user privileges, or network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires user interaction but has been assigned a ZDI identifier (ZDI-CAN-20660) suggesting active research
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-1452/
Restart Required: Yes
Instructions:
1. Visit Ashlar-Vellum support portal
2. Download latest Cobalt update
3. Install update following vendor instructions
4. Restart system
🔧 Temporary Workarounds
Block AR file extensions
allPrevent AR files from being opened by Cobalt
Application control
allRestrict Cobalt from opening files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized execution
- Use network segmentation to isolate affected systems
- Educate users about not opening untrusted AR files
- Monitor for suspicious process creation from Cobalt
🔍 How to Verify
Check if Vulnerable:
Check Cobalt version against vendor advisoryCheck Version:
Check Help > About in Cobalt applicationVerify Fix Applied:
Verify installed version matches patched version from vendor📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of Cobalt
- Suspicious child processes spawned from Cobalt
- AR file parsing errors
Network Indicators:
- Outbound connections from Cobalt to unknown IPs
- DNS requests to suspicious domains after AR file processing
SIEM Query:
Process Creation where ParentImage contains 'cobalt' AND (CommandLine contains '.ar' OR Image contains suspicious patterns)