CVE-2024-23131 - Memory Corruption Vulnerability in Autodesk Applications through Malicious STP File Parsing

CVE-2024-23131 refers to a critical memory corruption vulnerability that affects multiple Autodesk applications. This vulnerability arises when certain Autodesk applications parse a maliciously crafted STP file through one of the following DLL modules: ASMIMPORT229A.dll, ASMKERN228A.dll, ASMkern229A.dll, or ASMDATAX228A.dll.

The vulnerability can lead to a memory corruption issue, resulting from a write access violation. If successfully exploited, this memory corruption vulnerability, combined with other vulnerabilities, can lead to code execution in the context of the current process.

In this deep dive, we will explore the vulnerability details, including code snippets, original references, and exploit information.

Vulnerability Details

When a maliciously crafted STP file is parsed through the affected DLL modules in Autodesk applications, an attacker could exploit the memory corruption vulnerability to execute arbitrary code within the context of the current process. Here is a code snippet showcasing the improper handling of the STP file input, leading to the memory corruption:

void vulnerable_function(INPUT1* input1, INPUT2* input2)
{
    ...
    unsigned int size = input1->size;
    char* data = (char*) malloc(size);
    memcpy(data, input1->data, size);
    ...
    stp_import(data, input2, ...);
    ...
}

In the above code snippet, the function first allocates memory based on the input size and then copies the input data to the allocated memory. The problem occurs when the stp_import function is called, and the input data is mishandled, causing a memory corruption.

Exploit Information

To exploit this vulnerability, an attacker needs to create a specially crafted STP file that would cause a memory corruption when parsed by the affected Autodesk applications. The malicious STP file could contain specific payloads designed to trigger the vulnerability, such as overly large data inputs or improper data formatting.

Upon opening the malicious STP file with an affected Autodesk application, the attacker could gain code execution privileges within the context of the currently running process. This would potentially allow the attacker to escalate privileges, compromise the affected system, or even propagate malware within a network.

Mitigation and Recommendations

Autodesk has acknowledged this issue and has released patches for affected applications. Users should update their Autodesk applications to the latest versions to protect against this vulnerability.

Here are the original references and links to the Autodesk Security Advisory

- CVE-2024-23131: link to the CVE database entry
- Autodesk Security Advisory: link to the bulletin/release notes

It is crucial that organizations assess the risk of this vulnerability and prioritize updating any affected Autodesk applications. In addition to applying security updates, it is also essential to practice safe cybersecurity habits, such as verifying attachments from unknown senders and using proper access controls and segmentation measures to reduce the risk of exploitation.

Conclusion

CVE-2024-23131 is a serious memory corruption vulnerability that affects multiple Autodesk applications through the parsing of malicious STP files. To protect against this exploit, users are urged to update their Autodesk applications to the latest versions and adopt safe cybersecurity practices to reduce the risks associated with malicious files.

Timeline

Published on: 02/22/2024 04:15:08 UTC
Last modified on: 08/01/2024 13:47:07 UTC