CVE-2024-37006
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious CATPRODUCT files in affected Autodesk applications. The memory corruption occurs through a write access violation in CC5Dll.dll, potentially leading to full system compromise. Users of vulnerable Autodesk software are affected.
💻 Affected Systems
- Autodesk Advance Steel
- Autodesk Civil 3D
- Autodesk Inventor
- Autodesk Navisworks
- Autodesk AutoCAD
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with system-level privileges, allowing complete compromise of the affected system and potential lateral movement.
Likely Case
Local privilege escalation or code execution in the context of the current user, enabling data theft, ransomware deployment, or persistence mechanisms.
If Mitigated
Limited impact through application sandboxing or restricted user permissions, potentially resulting in application crash only.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. The vulnerability must be chained with other vulnerabilities for full code execution as noted in the description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Autodesk Security Advisory ADSK-SA-2024-0009 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Open affected Autodesk application. 2. Navigate to Help > About > Check for Updates. 3. Install all available security updates. 4. Restart the application and system as prompted.
🔧 Temporary Workarounds
Restrict CATPRODUCT file handling
windowsBlock or restrict opening of CATPRODUCT files through application settings or group policy
User awareness training
allTrain users not to open CATPRODUCT files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized binaries
- Use least privilege principles and run applications with restricted user accounts
🔍 How to Verify
Check if Vulnerable:
Check Autodesk application version against affected versions listed in ADSK-SA-2024-0009Check Version:
In Autodesk application: Help > About [Application Name]Verify Fix Applied:
Verify application version has been updated to patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes with access violation errors
- Unexpected process creation from Autodesk applications
- Suspicious file operations involving CATPRODUCT files
Network Indicators:
- Unusual outbound connections from Autodesk processes
- File downloads of CATPRODUCT files from untrusted sources
SIEM Query:
Process Creation where (Image contains 'acad.exe' OR Image contains 'inventor.exe') AND CommandLine contains '.CATPRODUCT'