CVE-2024-8598
📋 TL;DR
A memory corruption vulnerability in Autodesk AutoCAD's ACTranslators.exe allows attackers to execute arbitrary code by tricking users into opening malicious STP files. This affects AutoCAD users who process untrusted STP files. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad Mep by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with current user privileges, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or limited code execution for privilege escalation if combined with other vulnerabilities.
If Mitigated
Denial of service through application crash if proper network segmentation and file validation are in place.
🎯 Exploit Status
Requires user interaction to open malicious STP file. Memory corruption vulnerabilities often lead to reliable exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2024-0019 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
Restart Required: Yes
Instructions:
1. Open AutoCAD. 2. Navigate to Help > About. 3. Check for updates. 4. Install available security updates. 5. Restart AutoCAD and system if prompted.
🔧 Temporary Workarounds
Disable STP file association
windowsPrevent AutoCAD from automatically opening STP files
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Change .stp association to Notepad or other safe viewer
Implement file validation
windowsUse application whitelisting to block untrusted STP files
Windows: Configure AppLocker or Windows Defender Application Control to restrict STP file execution
🧯 If You Can't Patch
- Implement network segmentation to isolate AutoCAD workstations
- Educate users to never open STP files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against patched versions listed in Autodesk Security Advisory ADSK-SA-2024-0019Check Version:
In AutoCAD: Type 'ABOUT' command or check Help > About dialogVerify Fix Applied:
Verify AutoCAD version is updated to patched version and test with known safe STP files📡 Detection & Monitoring
Log Indicators:
- Application crashes of ACTranslators.exe
- Unexpected process creation from AutoCAD
- Multiple failed STP file parsing attempts
Network Indicators:
- Unusual outbound connections from AutoCAD workstations
- STP file downloads from suspicious sources
SIEM Query:
Process:ACTranslators.exe AND (EventID:1000 OR EventID:1001) OR FileExtension:.stp AND SourceIP:(suspicious_ips)