CVE-2024-8592
📋 TL;DR
A memory corruption vulnerability in Autodesk AutoCAD's CATPART file parser allows attackers to crash the application, leak sensitive data, or execute arbitrary code. This affects AutoCAD users who open malicious CATPART files. The vulnerability requires user interaction to open a crafted file.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad Mep by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the AutoCAD process, potentially leading to full system compromise.
Likely Case
Application crash or denial of service when opening malicious files, with potential for data exfiltration.
If Mitigated
Limited impact if users only open trusted files from verified sources.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. No public exploit code available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2024-0020 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0020
Restart Required: Yes
Instructions:
1. Open AutoCAD
2. Navigate to Help > About
3. Check for updates or use Autodesk Desktop App
4. Apply available security updates
5. Restart AutoCAD
🔧 Temporary Workarounds
Disable CATPART file association
windowsRemove file type association to prevent AutoCAD from automatically opening CATPART files
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .CATPart association
User education and file filtering
allTrain users to only open trusted files and implement email/web filtering for CATPART files
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized AutoCAD execution
- Use network segmentation to isolate AutoCAD workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against affected versions listed in Autodesk advisoryCheck Version:
In AutoCAD: Help > About or command line: acad.exe /versionVerify Fix Applied:
Verify AutoCAD version is updated to patched version specified in advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes in AutoCAD with AcTranslators.exe
- Unexpected file opens of CATPART files
- Memory access violations in application logs
Network Indicators:
- Downloads of CATPART files from untrusted sources
- Unusual outbound connections from AutoCAD process
SIEM Query:
source="autocad_logs" AND (event="crash" OR event="memory_violation") AND process="AcTranslators.exe"