CVE-2024-23150
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or cause crashes by tricking users into opening malicious PRT files in Autodesk AutoCAD. It affects AutoCAD users who open untrusted PRT files, potentially leading to complete system compromise.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment
Likely Case
Application crash or limited data corruption from targeted attacks
If Mitigated
No impact if files are from trusted sources and patches are applied
🎯 Exploit Status
Requires user to open malicious file; no authentication bypass needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk security advisory for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
Restart Required: Yes
Instructions:
1. Open AutoCAD
2. Go to Help > Check for Updates
3. Install available security updates
4. Restart AutoCAD
🔧 Temporary Workarounds
Block PRT file extensions
windowsPrevent AutoCAD from opening PRT files via group policy or application settings
User awareness training
allTrain users to only open PRT files from trusted sources
🧯 If You Can't Patch
- Restrict user permissions to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against patched versions in Autodesk advisoryCheck Version:
In AutoCAD: Help > About AutoCADVerify Fix Applied:
Verify AutoCAD version is updated to patched version listed in advisory📡 Detection & Monitoring
Log Indicators:
- AutoCAD crash logs with odxug_dll.dll errors
- Unexpected process creation from AutoCAD
Network Indicators:
- Unusual outbound connections from AutoCAD process
SIEM Query:
Process creation where parent process contains 'acad.exe' and command line contains suspicious parameters