CVE-2024-9723
📋 TL;DR
This is a use-after-free vulnerability in Trimble SketchUp Viewer's SKP file parser that allows remote attackers to execute arbitrary code. Attackers can exploit it by tricking users into opening malicious SKP files or visiting malicious web pages. All users of affected SketchUp Viewer versions are at risk.
💻 Affected Systems
- Trimble SketchUp Viewer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation on the victim's system, potentially leading to credential theft, data exfiltration, or system disruption.
If Mitigated
Limited impact if proper application sandboxing, least privilege principles, and network segmentation are implemented.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file), but the vulnerability itself is unauthenticated. File format vulnerabilities are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Trimble security advisory for specific version
Vendor Advisory: https://help.sketchup.com/en/release-notes/sketchup-viewer
Restart Required: Yes
Instructions:
1. Open SketchUp Viewer
2. Go to Help > Check for Updates
3. Follow prompts to install latest version
4. Restart application
🔧 Temporary Workarounds
Disable SKP file association
windowsPrevent SketchUp Viewer from automatically opening SKP files
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Select .skp > Change program > Choose different application
Application control policy
allBlock SketchUp Viewer execution via endpoint protection
🧯 If You Can't Patch
- Implement application sandboxing/containerization
- Use network segmentation to isolate SketchUp Viewer systems
🔍 How to Verify
Check if Vulnerable:
Check SketchUp Viewer version against Trimble's security advisoryCheck Version:
Windows: Open SketchUp Viewer > Help > About SketchUp ViewerVerify Fix Applied:
Verify installed version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Multiple crash reports from SketchUp Viewer
- Unexpected process creation from SketchUp Viewer
Network Indicators:
- Unexpected outbound connections from SketchUp Viewer process
SIEM Query:
Process creation where parent process contains 'sketchup' AND (command line contains .skp OR network connection established)