CVE-2024-9721
📋 TL;DR
A use-after-free vulnerability in Trimble SketchUp Viewer's SKP file parsing allows remote attackers to execute arbitrary code when a user opens a malicious SKP file or visits a malicious webpage. This affects all users of vulnerable SketchUp Viewer installations. Successful exploitation gives attackers control over the victim's system within the context of the current process.
💻 Affected Systems
- Trimble SketchUp Viewer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation, credential theft, or lateral movement within the network after user opens a malicious file.
If Mitigated
Limited to application crash or denial of service if exploit fails or security controls block execution.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. Weaponization likely given RCE nature and ZDI disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Trimble security advisory for specific patched version
Vendor Advisory: https://www.trimble.com/security/advisories
Restart Required: Yes
Instructions:
1. Open SketchUp Viewer
2. Go to Help > Check for Updates
3. Install available updates
4. Restart application
🔧 Temporary Workarounds
Disable SKP file association
windowsPrevent automatic opening of SKP files with SketchUp Viewer
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Change .skp association to Notepad or other safe viewer
Application whitelisting
windowsBlock SketchUp Viewer execution via AppLocker or similar
🧯 If You Can't Patch
- Implement network segmentation to isolate SketchUp Viewer systems
- Use email/web filtering to block SKP attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check SketchUp Viewer version against Trimble's patched version listCheck Version:
Windows: Open SketchUp Viewer > Help > About SketchUp ViewerVerify Fix Applied:
Confirm version is updated to patched release and test with known safe SKP files📡 Detection & Monitoring
Log Indicators:
- Application crashes of SketchUp Viewer
- Unusual process spawning from SketchUp Viewer
Network Indicators:
- Unexpected outbound connections from SketchUp Viewer process
SIEM Query:
Process creation where parent process contains 'sketchup' AND child process is suspicious (cmd.exe, powershell.exe, etc)