CVE-2024-23154
📋 TL;DR
This vulnerability allows attackers to exploit a heap-based buffer overflow in Autodesk applications when processing malicious SLDPRT files. Attackers can crash applications, read sensitive data, or execute arbitrary code with the privileges of the current user. Users of affected Autodesk software are vulnerable when opening untrusted SLDPRT files.
💻 Affected Systems
- Autodesk applications using ODXSW_DLL.dll
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the current user, potentially leading to full system compromise.
Likely Case
Application crashes and potential information disclosure when users open malicious SLDPRT files.
If Mitigated
Limited impact if users only open trusted files and applications run with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk advisory ADSK-SA-2024-0010 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
Restart Required: Yes
Instructions:
1. Visit the Autodesk security advisory. 2. Identify affected products and versions. 3. Update to the latest patched version through Autodesk's update mechanism or download from official sources. 4. Restart the application and system if required.
🔧 Temporary Workarounds
Restrict SLDPRT file handling
allConfigure applications to not automatically open SLDPRT files or use application whitelisting to block untrusted files.
Run with reduced privileges
windowsRun Autodesk applications with limited user privileges to reduce impact of potential code execution.
🧯 If You Can't Patch
- Implement strict file handling policies: only open SLDPRT files from trusted sources.
- Use application control solutions to restrict execution of Autodesk applications or block processing of SLDPRT files.
🔍 How to Verify
Check if Vulnerable:
Check your Autodesk software version against the affected versions listed in Autodesk advisory ADSK-SA-2024-0010.Check Version:
Within Autodesk application: Help → About or check through Autodesk Desktop App.Verify Fix Applied:
Verify that your Autodesk software has been updated to a version not listed as vulnerable in the advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening SLDPRT files
- Unexpected process termination of Autodesk applications
Network Indicators:
- Downloads of SLDPRT files from untrusted sources
- Unusual outbound connections from Autodesk processes
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName contains 'Autodesk' AND ExceptionCode='0xc0000005'