CVE-2024-9500
📋 TL;DR
This vulnerability allows attackers to escalate privileges to SYSTEM level by placing a malicious DLL in temporary directories used by Autodesk Installer. It affects systems running vulnerable Autodesk software where the installer runs with elevated privileges. The issue stems from insecure privilege management in the installer's temporary file handling.
💻 Affected Systems
- Autodesk Installer
📦 What is this software?
Installer by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege compromise allowing complete control over the affected system, installation of persistent malware, credential theft, and lateral movement.
Likely Case
Local privilege escalation from a lower-privileged user account to SYSTEM, enabling installation of unauthorized software, configuration changes, and persistence mechanisms.
If Mitigated
Limited impact with proper access controls preventing unauthorized users from writing to temporary directories and monitoring for suspicious DLL loading.
🎯 Exploit Status
Exploitation requires local access and ability to write to temporary directories used by Autodesk Installer.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory; update to latest Autodesk Installer
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0023
Restart Required: Yes
Instructions:
1. Visit Autodesk Account portal. 2. Download latest installer updates. 3. Run installer with administrative privileges. 4. Restart affected systems.
🔧 Temporary Workarounds
Restrict temporary directory permissions
windowsSet strict ACLs on Autodesk temporary directories to prevent unauthorized DLL placement
icacls "C:\ProgramData\Autodesk\*" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W)"
Monitor DLL loading from temp directories
windowsImplement monitoring for DLL loading from temporary directories by Autodesk processes
Sysmon configuration to monitor CreateRemoteThread and LoadImage events from Autodesk processes
🧯 If You Can't Patch
- Implement strict access controls preventing non-admin users from writing to Autodesk temporary directories
- Monitor for suspicious DLL files in Autodesk temporary directories and alert on creation
🔍 How to Verify
Check if Vulnerable:
Check if Autodesk software uses older installer versions by examining installation logs or checking installer version in Program Files\Autodesk directoriesCheck Version:
wmic product where "name like 'Autodesk%'" get name,versionVerify Fix Applied:
Verify installer has been updated by checking version in Control Panel > Programs and Features or running installer with /? flag📡 Detection & Monitoring
Log Indicators:
- DLL loading from temporary directories by Autodesk installer processes
- Unauthorized file creation in Autodesk temp directories
- Process creation with SYSTEM privileges from Autodesk installer
Network Indicators:
- Unusual outbound connections following Autodesk installer execution
SIEM Query:
EventID=7 OR EventID=11 AND (Image LIKE '%Autodesk%' OR ProcessName LIKE '%Autodesk%') AND (TargetFilename LIKE '%temp%' OR TargetFilename LIKE '%tmp%')