CVE-2024-5509
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Luxion KeyShot installations by tricking users into opening malicious BIP files. The flaw exists in how KeyShot loads libraries from unsecured locations during BIP file parsing. All users running vulnerable versions of KeyShot are affected.
💻 Affected Systems
- Luxion KeyShot
📦 What is this software?
Keyshot by Luxion
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the KeyShot user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the user's system when opening a malicious BIP file from email or downloads.
If Mitigated
Limited impact if user runs with minimal privileges and doesn't open untrusted files, though code execution still possible.
🎯 Exploit Status
Exploitation requires user to open malicious file. DLL hijacking/planting attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific fixed version
Vendor Advisory: https://www.keyshot.com/csirt/
Restart Required: Yes
Instructions:
1. Visit https://www.keyshot.com/csirt/
2. Download and install the latest KeyShot update
3. Restart KeyShot and verify version
🔧 Temporary Workarounds
Restrict BIP file handling
allConfigure system to open BIP files with alternative applications or block execution
Run with reduced privileges
allRun KeyShot with limited user account to reduce impact
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Educate users to never open BIP files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check KeyShot version against vendor advisory. If using vulnerable version and opening BIP files, system is vulnerable.Check Version:
In KeyShot: Help → About KeyShotVerify Fix Applied:
Verify KeyShot version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- KeyShot loading DLLs from unusual locations
- Process creation from KeyShot with suspicious parent-child relationships
Network Indicators:
- Outbound connections from KeyShot process to suspicious IPs
SIEM Query:
Process creation where parent process contains 'keyshot' and child process is suspicious executable