CVE-2024-12178
📋 TL;DR
This vulnerability allows remote code execution through memory corruption when Autodesk Navisworks processes a malicious DWFX file. Attackers can exploit this to run arbitrary code with the privileges of the Navisworks process. Organizations using affected versions of Navisworks are at risk.
💻 Affected Systems
- Autodesk Navisworks
📦 What is this software?
Navisworks by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malicious actor gains control of the Navisworks process, potentially accessing sensitive design files and executing further attacks.
If Mitigated
Limited impact due to application sandboxing, network segmentation, and user privilege restrictions.
🎯 Exploit Status
Requires user to open a malicious DWFX file. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3 and later updates
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
Restart Required: Yes
Instructions:
1. Open Autodesk Navisworks. 2. Navigate to Help > About. 3. Check current version. 4. If below 2024.3, download and install the latest update from Autodesk Account portal. 5. Restart the application.
🔧 Temporary Workarounds
Disable DWFX file association
windowsPrevent Navisworks from automatically opening DWFX files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dwfx to open with Notepad or another safe viewer
User awareness training
allEducate users to avoid opening DWFX files from untrusted sources
🧯 If You Can't Patch
- Restrict user privileges to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Open Navisworks > Help > About > Check if version is 2024.2 or earlierCheck Version:
Not applicable - check via GUI in Help > AboutVerify Fix Applied:
Confirm version is 2024.3 or later in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Application crashes in Navisworks
- Unexpected process creation from Navisworks.exe
Network Indicators:
- Outbound connections from Navisworks to unusual destinations
SIEM Query:
EventID=1000 Source='Navisworks' OR ProcessName='Navisworks.exe' AND CommandLine CONTAINS '.dwfx'