CVE-2024-30374

Executive Summary

CVE-2024-30374 is a critical Out-Of-Bounds Write vulnerability in Luxion KeyShot Viewer, specifically during the parsing of KSP files. This flaw allows remote attackers to execute arbitrary code on the victim's system, provided the user interacts with a malicious KSP file or visits a compromised web page that triggers the file parsing. The vulnerability has a CVSS score of 7.8 (High) and is classified under CWE-787 (Out-of-bounds Write). No public exploit code or patch is currently available, making this a high-priority threat for organizations using Luxion KeyShot Viewer. The attack vector is local, requiring user interaction, but the impact on confidentiality, integrity, and availability is complete.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access or trick the user into opening a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data compromise possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. The lack of a patch and the potential for remote code execution make this a critical risk for any organization using Luxion KeyShot Viewer.

Deep Dive & Mechanics

The vulnerability resides in the KSP file parsing routine of Luxion KeyShot Viewer. KSP files are proprietary scene files used by KeyShot for 3D rendering. The specific flaw is an out-of-bounds write, meaning the software writes data beyond the allocated buffer boundary. This occurs because the parser does not properly validate the size or offset of user-supplied data within the KSP file.

When a crafted KSP file is opened, the parser reads a field that specifies the length of a data block. Due to insufficient validation, an attacker can manipulate this field to cause the parser to write data past the end of the allocated buffer. This overwrites adjacent memory, potentially corrupting critical data structures or injecting shellcode. The attacker can then hijack the execution flow to achieve arbitrary code execution in the context of the current process (typically the user running KeyShot Viewer).

The vulnerability was reported via ZDI-CAN-22449, indicating it was responsibly disclosed through the Zero Day Initiative. However, the patch status remains unknown, suggesting the vendor may not have released a fix.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be provided. However, the vulnerable code likely resembles the following pseudo-code:

// Vulnerable code
void parse_KSP_data(char *buffer, size_t buffer_size) {
    uint32_t data_length;
    memcpy(&data_length, buffer, 4); // Read length from file
    char *data = malloc(data_length); // Allocate based on user input
    memcpy(data, buffer + 4, data_length); // Copy data - no bounds check
    // ... process data
}

A patched version would include a bounds check:

// Patched code
void parse_KSP_data(char *buffer, size_t buffer_size) {
    uint32_t data_length;
    if (buffer_size < 4) return; // Minimum size check
    memcpy(&data_length, buffer, 4);
    if (data_length > buffer_size - 4) return; // Bounds check
    char *data = malloc(data_length);
    if (data == NULL) return;
    memcpy(data, buffer + 4, data_length);
    // ... process data
}

The key difference is the addition of a validation step to ensure data_length does not exceed the remaining buffer size.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Luxion KeyShot Viewer installed on a target system.
• Ability to deliver a malicious KSP file (e.g., via email, web download, or USB).

Exploitation Steps:

1. Craft Malicious KSP File: Use a fuzzer or manual binary editing to modify a legitimate KSP file. Overwrite the data length field with a value larger than the actual buffer size.
2. Deliver Payload: Embed shellcode in the KSP file that will be written out-of-bounds. The shellcode should be designed to execute a reverse shell or download a second-stage payload.
3. Trigger Vulnerability: Convince the user to open the malicious KSP file in KeyShot Viewer. The out-of-bounds write will corrupt memory and redirect execution to the shellcode.
4. Achieve Code Execution: The shellcode runs in the context of the user, allowing the attacker to execute arbitrary commands.

Example Payload (Conceptual):

# Python script to craft a malicious KSP file
import struct

def craft_malicious_ksp():
    # Legitimate KSP header
    header = b'\x4B\x53\x50\x00'  # "KSP\0"
    # Malicious data length (large value)
    data_length = 0xFFFFFFFF
    # Shellcode (placeholder)
    shellcode = b'\x90' * 100  # NOP sled + actual shellcode
    # Craft file
    with open('malicious.ksp', 'wb') as f:
        f.write(header)
        f.write(struct.pack('<I', data_length))
        f.write(shellcode)
    print("Malicious KSP file created: malicious.ksp")

craft_malicious_ksp()

Note: No public exploit code is available. The above is a conceptual example for educational purposes.

Blue Team (Defense)

Detection:

• Monitor for unusual KSP file downloads or email attachments.
• Use endpoint detection and response (EDR) tools to detect out-of-bounds write attempts.
• Implement application whitelisting to prevent unauthorized execution of KeyShot Viewer.

Mitigation:

• Restrict user permissions to run KeyShot Viewer only when necessary.
• Use sandboxing or virtualization to open untrusted KSP files.
• Apply strict file validation before opening KSP files (e.g., check file size and structure).

Hunting:

• Search for processes that crash with memory access violations when parsing KSP files.
• Look for suspicious child processes spawned by KeyShot Viewer.

Indicators of Compromise (IOCs)

• File Hashes: (No specific hashes available; monitor for unknown KSP files)
• Network Indicators: Outbound connections from KeyShot Viewer to unknown IPs (if shellcode initiates a reverse shell).
• Process Indicators: KeyShot Viewer process (e.g., ksviewer.exe) crashing or exhibiting abnormal memory usage.
• Registry/File System: Creation of suspicious files in temporary directories or startup folders.
• YARA Rule (see Detection Engineering): Detects malicious KSP files with oversized data length fields.

Detection Engineering

YARA Rule

rule CVE_2024_30374_Malicious_KSP {
    meta:
        description = "Detects malicious KSP files exploiting CVE-2024-30374"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-30374"
    strings:
        $ksp_header = "KSP" at 0
        $large_length = { FF FF FF 7F } // Data length > 2GB
    condition:
        $ksp_header and $large_length
}

Sigma Rule

title: CVE-2024-30374 - Luxion KeyShot Viewer KSP File Parsing Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-30374 via malicious KSP files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ksviewer.exe'
        CommandLine|contains: '.ksp'
    condition: selection
falsepositives:
    - Legitimate KSP file usage
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30374 - Luxion KeyShot Viewer KSP File Download"; flow:to_server,established; content:"KSP"; offset:0; depth:3; content:"|FF FF FF 7F|"; distance:3; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Uninstall: If possible, remove Luxion KeyShot Viewer until a patch is available.
2. Restrict Access: Use application control policies to block execution of KeyShot Viewer for non-administrative users.
3. User Awareness: Train users not to open KSP files from untrusted sources.

Long-Term Fix:

• Monitor the vendor's website for a security patch. Apply it as soon as it becomes available.
• Consider using alternative 3D viewing software that is actively maintained.

Workaround:

• Use a file scanner that can detect oversized data length fields in KSP files (e.g., custom YARA rule).

Valters IT