CVE-2024-36999
📋 TL;DR
This vulnerability allows an attacker to execute arbitrary code or cause a denial-of-service by tricking a user into opening a malicious 3DM file in affected Autodesk applications. It affects users of Autodesk software that uses the opennurbs.dll library for parsing 3DM files. Exploitation requires user interaction, such as opening a crafted file.
💻 Affected Systems
- Autodesk applications using opennurbs.dll for 3DM file parsing, such as AutoCAD, Fusion 360, and other 3D design tools
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full control of the system by executing arbitrary code in the context of the current user, potentially leading to data theft, ransomware deployment, or further network compromise.
Likely Case
An attacker causes a crash (denial-of-service) or writes sensitive data from memory, disrupting workflows or leaking information.
If Mitigated
With proper controls like restricted file handling and user awareness, impact is limited to isolated crashes or minimal data exposure.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file; no public proof-of-concept is known, but the vulnerability is rated with a high CVSS score indicating significant risk.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Autodesk advisory for specific patched versions per product.
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
Restart Required: Yes
Instructions:
1. Visit the Autodesk advisory URL. 2. Identify affected products and versions. 3. Download and install the latest updates from Autodesk's official channels. 4. Restart the application or system as required.
🔧 Temporary Workarounds
Restrict 3DM file handling
allBlock or limit the opening of 3DM files from untrusted sources to reduce attack surface.
Use application sandboxing
allRun Autodesk applications in isolated environments to contain potential exploits.
🧯 If You Can't Patch
- Implement strict user training to avoid opening 3DM files from unknown or untrusted sources.
- Deploy endpoint detection and response (EDR) tools to monitor for suspicious file execution and memory corruption events.
🔍 How to Verify
Check if Vulnerable:
Check the version of the Autodesk application and compare it against the patched versions listed in the vendor advisory.Check Version:
On Windows: Check via 'About' in the application or use system information tools; command varies by product.Verify Fix Applied:
Confirm that the application version matches or exceeds the patched version specified by Autodesk.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to opennurbs.dll
- Unexpected file parsing errors in Autodesk application logs
Network Indicators:
- Unusual outbound connections after opening a 3DM file
SIEM Query:
Example: 'event_source:"Autodesk Application" AND (event_type:"Crash" OR file_extension:".3dm")'