CVE-2024-45143
📋 TL;DR
CVE-2024-45143 is a heap-based buffer overflow vulnerability in Adobe Substance3D Stager that could allow arbitrary code execution when a user opens a malicious file. This affects users of Substance3D Stager versions 3.0.3 and earlier, potentially compromising their systems.
💻 Affected Systems
- Adobe Substance3D Stager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the user's computer, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to data exfiltration, malware installation, or persistence mechanisms being established on the compromised system.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and heap manipulation knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.4 or later
Vendor Advisory: https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
Restart Required: Yes
Instructions:
1. Open Substance3D Stager. 2. Go to Help > Check for Updates. 3. Install version 3.0.4 or later. 4. Restart the application.
🔧 Temporary Workarounds
Restrict file processing
allConfigure application to only open trusted files from verified sources
Application sandboxing
allRun Substance3D Stager in restricted mode or sandbox environment
🧯 If You Can't Patch
- Restrict user permissions to prevent system-wide compromise if exploited
- Implement application whitelisting to block unauthorized file execution
🔍 How to Verify
Check if Vulnerable:
Check Substance3D Stager version in application settings or About dialogCheck Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 3.0.4 or later in application settings📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected file processing from untrusted sources
Network Indicators:
- Unusual outbound connections after file processing
SIEM Query:
EventID=1000 OR EventID=1001 with Substance3D Stager process name