CVE-2024-9725
📋 TL;DR
This is a use-after-free vulnerability in Trimble SketchUp Viewer's SKP file parser that allows remote attackers to execute arbitrary code. Attackers can exploit it by tricking users into opening malicious SKP files or visiting malicious web pages. Users of affected SketchUp Viewer versions are at risk.
💻 Affected Systems
- Trimble SketchUp Viewer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation leading to malware installation, data exfiltration, or persistence mechanisms being established on the compromised system.
If Mitigated
Limited impact due to sandboxing, application whitelisting, or restricted user privileges preventing full system compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability is in ZDI's disclosure program (ZDI-CAN-24109).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Trimble security advisory for specific patched version
Vendor Advisory: https://www.trimble.com/security/advisories
Restart Required: Yes
Instructions:
1. Open SketchUp Viewer
2. Go to Help > Check for Updates
3. Install available updates
4. Restart application
🔧 Temporary Workarounds
Disable SKP file association
windowsPrevent SketchUp Viewer from automatically opening SKP files
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Change .skp association to another program or none
User awareness training
allTrain users not to open SKP files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to block SketchUp Viewer execution
- Use sandboxing solutions to isolate SketchUp Viewer
🔍 How to Verify
Check if Vulnerable:
Check SketchUp Viewer version against Trimble's security advisoryCheck Version:
Windows: Open SketchUp Viewer > Help > About SketchUp ViewerVerify Fix Applied:
Verify version is updated to patched version listed in Trimble advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected SketchUp Viewer crashes
- Process creation from SketchUp Viewer with unusual parameters
Network Indicators:
- Outbound connections from SketchUp Viewer to unknown IPs
- DNS requests for suspicious domains after file open
SIEM Query:
Process creation where parent process is SketchUp Viewer AND (command line contains unusual parameters OR destination IP is suspicious)