CVE-2024-23152
📋 TL;DR
This vulnerability allows attackers to exploit a buffer overflow in Autodesk's opennurbs.dll library when processing malicious 3DM files. Successful exploitation could lead to arbitrary code execution, data theft, or application crashes. Users of affected Autodesk applications are at risk.
💻 Affected Systems
- Autodesk applications using opennurbs.dll
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the current user, potentially leading to full system compromise.
Likely Case
Application crash or denial of service, with potential for limited data exfiltration.
If Mitigated
Application crash with no data exposure if proper sandboxing and memory protections are in place.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Autodesk security advisory ADSK-SA-2024-0010 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
Restart Required: Yes
Instructions:
1. Identify affected Autodesk applications
2. Check Autodesk security advisory ADSK-SA-2024-0010
3. Update to the latest patched version
4. Restart the application
🔧 Temporary Workarounds
Restrict 3DM file processing
allBlock or restrict processing of 3DM files from untrusted sources
Application sandboxing
allRun Autodesk applications with reduced privileges or in sandboxed environments
🧯 If You Can't Patch
- Implement strict file validation for 3DM files
- Use application whitelisting to prevent unauthorized execution
🔍 How to Verify
Check if Vulnerable:
Check if opennurbs.dll version is prior to the patched release mentioned in Autodesk advisoryCheck Version:
Check application About menu or use vendor-specific version checking toolsVerify Fix Applied:
Verify application version matches or exceeds the patched version in Autodesk advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing 3DM files
- Memory access violation errors in application logs
Network Indicators:
- Unusual file downloads of 3DM files
- Network traffic from Autodesk applications to unexpected destinations
SIEM Query:
Search for application crash events related to Autodesk processes or memory access violations