CVE-2024-11581

Executive Summary

CVE-2024-11581 is a critical out-of-bounds read vulnerability in Luxion KeyShot, a professional 3D rendering and animation application. The flaw resides in the parsing of JT (Jupiter Tessellation) files, a common 3D data format used in engineering and manufacturing. An attacker can exploit this by convincing a user to open a specially crafted JT file, leading to remote code execution (RCE) in the context of the current process. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, but the risk is significant due to the widespread use of KeyShot in industrial design and engineering sectors.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must deliver a malicious file to the target system.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond opening the file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The exploit affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. The vulnerability is unpatched, and while no public exploit exists, the attack vector is straightforward (phishing with a malicious JT file). The impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability is a classic out-of-bounds read (CWE-125) in the JT file parsing module of Luxion KeyShot. JT files are binary 3D data containers that include geometry, attributes, and metadata. The specific flaw occurs when the parser reads a length field from the file without proper validation. This leads to a read operation that starts before the beginning of an allocated buffer, allowing an attacker to control the read offset and potentially leak sensitive memory or execute arbitrary code.

Technical Breakdown:

1. Trigger: The attacker crafts a JT file with a malformed segment header, specifically manipulating a length field to be negative or excessively large.
2. Parsing: KeyShot's parser attempts to read data from the file into a buffer. The manipulated length causes the parser to calculate a read offset that is before the buffer's start.
3. Out-of-Bounds Read: The read operation accesses memory outside the intended buffer, potentially reading sensitive data or overwriting adjacent memory structures.
4. Code Execution: By carefully controlling the out-of-bounds read, an attacker can corrupt function pointers or return addresses, leading to arbitrary code execution.

Root Cause: Lack of proper validation of user-supplied data (the length field) before using it in a memory operation.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding bounds checking before the read operation.

Vulnerable Code (Conceptual C++):

void ParseJTSegment(const char* data, size_t size) {
    int32_t length = *(int32_t*)data; // No validation
    char* buffer = new char[length];
    memcpy(buffer, data + 4, length); // Potential out-of-bounds read if length is negative or too large
}

Patched Code (Conceptual C++):

void ParseJTSegment(const char* data, size_t size) {
    if (size < 4) return; // Minimum size check
    int32_t length = *(int32_t*)data;
    if (length <= 0 || length > size - 4) return; // Bounds check
    char* buffer = new char[length];
    memcpy(buffer, data + 4, length);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Windows 10/11 with Luxion KeyShot (any version) installed.
• Attacker: Kali Linux or any system with a JT file generator.
• Tooling: Python with struct module for binary crafting.

Exploitation Steps:

1. Craft Malicious JT File: Create a JT file with a manipulated segment header. The header contains a length field set to a negative value (e.g., -1) to trigger the out-of-bounds read.
2. Deliver File: Send the file via email or a download link, using social engineering to convince the user to open it.
3. Trigger: When the user opens the file in KeyShot, the parser reads the malformed header, causing a controlled out-of-bounds read.
4. Code Execution: The out-of-bounds read corrupts a function pointer, redirecting execution to attacker-controlled shellcode.

Example Python Script (Conceptual):

import struct

def create_malicious_jt(filename):
    # JT file header (simplified)
    header = b'\x4A\x54\x00\x01'  # Magic bytes and version
    # Malformed segment: length = -1 (0xFFFFFFFF)
    segment_header = struct.pack('<i', -1)  # Negative length
    segment_data = b'A' * 100  # Padding
    with open(filename, 'wb') as f:
        f.write(header)
        f.write(segment_header)
        f.write(segment_data)

create_malicious_jt('exploit.jt')

Note: This is a conceptual example. Actual exploitation requires precise memory layout knowledge.

Blue Team (Defense)

Detection:

• Monitor for unusual JT file downloads or email attachments.
• Use endpoint detection and response (EDR) to detect KeyShot crashes or anomalous memory access patterns.
• Implement application whitelisting to prevent KeyShot from executing untrusted code.

Mitigation:

• Disable JT file parsing in KeyShot if not needed.
• Use a sandbox or virtualized environment for opening untrusted JT files.
• Apply strict file validation before opening (e.g., check file size and structure).

Indicators of Compromise (IOCs)

• File Hashes: (None available yet, but monitor for malicious JT files)
• Network: Outbound connections from KeyShot process to unknown IPs (potential C2).
• Process: KeyShot.exe crashing with access violation errors.
• Registry: Unusual modifications to KeyShot settings.
• Memory: Presence of shellcode or unusual memory allocations in KeyShot process.

Detection Engineering

YARA Rule

rule CVE_2024_11581_JT_Malformed {
    meta:
        description = "Detects malformed JT files exploiting CVE-2024-11581"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11581"
    strings:
        $magic = { 4A 54 } // JT magic bytes
        $neg_length = { FF FF FF FF } // Negative length field
    condition:
        $magic at 0 and $neg_length
}

Sigma Rule

title: CVE-2024-11581 KeyShot JT File Parsing Exploit
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects KeyShot crashes or anomalous behavior indicative of CVE-2024-11581 exploitation
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\KeyShot.exe'
        CommandLine|contains: '.jt'
    condition: selection
falsepositives:
    - Legitimate JT file processing
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11581 KeyShot JT File Download"; flow:to_server,established; content:"|4A 54|"; offset:0; depth:2; content:"|FF FF FF FF|"; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable JT file parsing in KeyShot if possible. Use a file validation tool to check JT files before opening.
• Short-term: Monitor vendor for patches. Apply workarounds such as running KeyShot in a sandbox.
• Long-term: Implement strict input validation in all file parsers. Use memory-safe languages or libraries for parsing complex formats.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert