CVE-2024-12199
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious DWFX files in Autodesk Navisworks. It affects all users of vulnerable Autodesk Navisworks versions who process untrusted DWFX files. The vulnerability stems from an out-of-bounds write when parsing specially crafted files.
💻 Affected Systems
- Autodesk Navisworks
📦 What is this software?
Navisworks by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the Navisworks process, potentially leading to full system compromise.
Likely Case
Application crash or denial of service when processing malicious files, with potential for limited code execution.
If Mitigated
No impact if patched versions are used or if DWFX files from untrusted sources are blocked.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploit code has been disclosed as of the advisory date.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3 and later
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
Restart Required: Yes
Instructions:
1. Open Autodesk Navisworks
2. Navigate to Help > About to check current version
3. If version is earlier than 2024.3, download and install the latest update from Autodesk Account
4. Restart the application after installation
🔧 Temporary Workarounds
Block DWFX file extensions
windowsPrevent processing of DWFX files through group policy or application controls
User awareness training
allTrain users not to open DWFX files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of vulnerable Navisworks versions
- Use network segmentation to isolate Navisworks systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check Navisworks version in Help > About menu. If version is earlier than 2024.3, the system is vulnerable.Check Version:
Not applicable - check through application GUIVerify Fix Applied:
Verify version is 2024.3 or later in Help > About menu and test with known safe DWFX files.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing DWFX files
- Unexpected process termination events in Windows Event Logs
Network Indicators:
- Downloads of DWFX files from untrusted sources
- Unusual outbound connections from Navisworks process
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="*navisworks*" AND ExceptionCode="0xc0000005"