CVE-2024-11581
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Luxion KeyShot installations by tricking users into opening malicious JT files. The flaw exists in JT file parsing where improper data validation enables out-of-bounds reads that can lead to remote code execution. Users of affected KeyShot versions who open untrusted JT files are at risk.
💻 Affected Systems
- Luxion KeyShot
📦 What is this software?
Keyshot by Luxion
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, data theft, lateral movement, and persistence establishment.
Likely Case
Local privilege escalation leading to system compromise, data exfiltration, and potential ransomware deployment.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires user interaction but weaponization is likely given the RCE potential. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1 and later
Vendor Advisory: https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf
Restart Required: Yes
Instructions:
1. Download KeyShot 2024.1 or later from official Luxion website
2. Run the installer and follow upgrade prompts
3. Restart the system after installation completes
🔧 Temporary Workarounds
Restrict JT file handling
allBlock or restrict opening of JT files through application policies or file association changes
Application sandboxing
allRun KeyShot in restricted/sandboxed environment to limit potential damage
🧯 If You Can't Patch
- Implement strict file handling policies to prevent opening untrusted JT files
- Run KeyShot with minimal user privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check KeyShot version in Help > About menu. Versions before 2024.1 are vulnerable.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Luxion\KeyShot\Version or check About dialogVerify Fix Applied:
Verify version is 2024.1 or later in Help > About menu and test opening known safe JT files.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening JT files
- Unusual process spawning from KeyShot
- Memory access violation errors
Network Indicators:
- Unexpected outbound connections from KeyShot process
- Downloads of JT files from untrusted sources
SIEM Query:
Process creation where parent process contains 'KeyShot' AND (command line contains '.jt' OR file path contains '.jt')