CVE-2024-7305
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or cause crashes by tricking users into opening malicious DWF files in AutoCAD. It affects AutoCAD users who process untrusted DWF files. The vulnerability exists in the AdDwfPdk.dll library.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Dwg Trueview by Autodesk
Dwg Trueview by Autodesk
Dwg Trueview by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the AutoCAD process, potentially leading to full system compromise.
Likely Case
Application crashes and denial of service when processing malicious files, with potential for limited code execution.
If Mitigated
No impact if patched or if users don't open untrusted DWF files.
🎯 Exploit Status
Requires user interaction to open malicious DWF file. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2024-0014 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0014
Restart Required: Yes
Instructions:
1. Open AutoCAD. 2. Go to Help > About. 3. Check for updates. 4. Install available updates. 5. Restart AutoCAD.
🔧 Temporary Workarounds
Disable DWF file association
windowsPrevent AutoCAD from automatically opening DWF files
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dwf association to another program
Block DWF files at perimeter
allFilter DWF files at email gateways and web proxies
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Educate users not to open DWF files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against Autodesk advisory. If using affected version and AdDwfPdk.dll is present, system is vulnerable.Check Version:
In AutoCAD: Help > About, or command line: acad.exe /versionVerify Fix Applied:
Verify AutoCAD version is updated to patched version listed in Autodesk advisory.📡 Detection & Monitoring
Log Indicators:
- AutoCAD crash logs with AdDwfPdk.dll in stack trace
- Unexpected process termination events
Network Indicators:
- DWF file downloads from untrusted sources
- Unusual outbound connections after DWF file processing
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="acad.exe" AND FaultModuleName="AdDwfPdk.dll"