CVE-2023-44437
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ashlar-Vellum Cobalt installations by tricking users into opening malicious files or visiting malicious pages. The flaw exists in how the software loads libraries from unsecured locations, enabling attackers to run code with the same privileges as the current process. Users of Ashlar-Vellum Cobalt who open untrusted files are affected.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation when users open malicious files from untrusted sources.
If Mitigated
Limited impact with proper user training and file restrictions, though the vulnerability remains present.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once malicious file is opened
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-1595/
Restart Required: Yes
Instructions:
1. Visit Ashlar-Vellum official website
2. Download latest patched version
3. Install update following vendor instructions
4. Restart system if prompted
🔧 Temporary Workarounds
Restrict file execution from untrusted locations
allConfigure system to prevent execution of files from temporary directories and network shares
User training and file restrictions
allEducate users to avoid opening untrusted files and implement policies to restrict file types
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Use endpoint protection with behavior monitoring to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Ashlar-Vellum Cobalt version against vendor's patched version listCheck Version:
Check application 'About' menu or installation directory for version informationVerify Fix Applied:
Verify installation of latest patched version from vendor📡 Detection & Monitoring
Log Indicators:
- Unexpected DLL/library loads from unusual locations
- Process spawning from Ashlar-Vellum Cobalt
Network Indicators:
- Unusual outbound connections from Ashlar-Vellum process
SIEM Query:
Process creation where parent process is Ashlar-Vellum Cobalt AND command line contains suspicious library paths