CVE-2024-34115
📋 TL;DR
CVE-2024-34115 is an out-of-bounds write vulnerability in Adobe Substance3D Stager that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Stager versions 2.1.4 and earlier. Successful exploitation requires user interaction but would execute code with the current user's privileges.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine and potentially pivoting to other systems in the network.
Likely Case
Local privilege escalation leading to data theft, ransomware deployment, or persistence establishment on the affected system.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of file format specifics.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb24-43.html
Restart Required: Yes
Instructions:
1. Open Substance3D Stager. 2. Go to Help > Check for Updates. 3. Follow prompts to install version 2.1.5 or later. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file opening
allConfigure application control policies to prevent opening untrusted .stager files
User awareness training
allTrain users to only open Substance3D Stager files from trusted sources
🧯 If You Can't Patch
- Run Substance3D Stager in a sandboxed environment with limited privileges
- Implement application control to block execution of older vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in application settings or About dialogCheck Version:
On Windows: Check 'Help > About Substance3D Stager'. On macOS: 'Substance3D Stager > About Substance3D Stager'Verify Fix Applied:
Verify version is 2.1.5 or later in application settings📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file opening events in Substance3D Stager
Network Indicators:
- Unusual outbound connections after opening .stager files
SIEM Query:
source="*" ("Substance3D Stager" AND (crash OR "access violation")) OR (process="Substance3D Stager" AND file_extension=".stager")