CVE-2024-30375

Executive Summary

CVE-2024-30375 is a critical use-after-free vulnerability in Luxion KeyShot Viewer, specifically during the parsing of KSP files. The flaw allows remote attackers to execute arbitrary code in the context of the current process, requiring user interaction (e.g., opening a malicious KSP file or visiting a malicious page). With a CVSS score of 7.8, this vulnerability poses a significant risk to users of KeyShot Viewer, particularly in environments where untrusted KSP files are processed. No public exploit or patch is currently available, but the risk is elevated due to the lack of validation of object existence before operations.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Luxion KeyShot Viewer) and is not part of a software supply chain ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Exploitation could lead to full compromise of the affected system, including data theft, malware installation, or lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the parsing logic of KSP files within Luxion KeyShot Viewer. The specific flaw is a use-after-free (UAF) condition, classified under CWE-416. When the application processes a crafted KSP file, it fails to validate the existence of an object before performing operations on it. This allows an attacker to free a memory object and then reference it, leading to arbitrary code execution.

Technical Details:

• Root Cause: Lack of proper validation of object pointers after memory deallocation.
• Trigger: Opening a malicious KSP file or visiting a web page that loads the file via the viewer.
• Impact: Remote code execution in the context of the current user process.
• Exploitability: Low complexity; no authentication required.

The vulnerability was reported via ZDI-CAN-22515 and is currently unpatched. No public exploit code or proof-of-concept is available.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code likely involves a pattern similar to:

// Vulnerable pseudo-code
Object* obj = parseObjectFromKSP(file);
// ... some operations that may free obj ...
obj->method(); // Use-after-free: obj may be dangling

A patched version would include a null check or reference counting:

// Patched pseudo-code
Object* obj = parseObjectFromKSP(file);
if (obj != nullptr) {
    // ... operations that may free obj ...
    if (obj != nullptr) {
        obj->method(); // Safe: obj is validated
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Luxion KeyShot Viewer installed on a target system.
• Ability to deliver a malicious KSP file (e.g., via email, download, or web page).

Exploitation Steps:

1. Craft a malicious KSP file that triggers the use-after-free condition.
2. Deliver the file to the target user (e.g., via phishing email or malicious website).
3. When the user opens the file with KeyShot Viewer, the exploit executes arbitrary code.

Note: No public exploit code is available. The following is a conceptual example:

# Conceptual exploit (not functional)
import struct

def craft_malicious_ksp():
    # Craft a KSP file that triggers UAF
    payload = b"\x00" * 100  # Placeholder
    # ... exploit logic ...
    with open("malicious.ksp", "wb") as f:
        f.write(payload)

craft_malicious_ksp()

Blue Team (Defense)

Detection:

• Monitor for unusual KeyShot Viewer crashes or memory access violations.
• Use endpoint detection and response (EDR) tools to detect anomalous process behavior.

Prevention:

• Restrict execution of KeyShot Viewer in sandboxed environments.
• Block KSP file downloads from untrusted sources.
• Implement application whitelisting.

Hunting:

• Search for KSP files with unusual sizes or structures.
• Analyze memory dumps for signs of heap corruption.

Indicators of Compromise (IOCs)

• File Hashes: No known malicious samples.
• Network Indicators: No known C2 domains.
• Process Indicators: KeyShot Viewer process (e.g., keyshot_viewer.exe) crashing or exhibiting abnormal memory access.
• Registry/File System: No known persistence mechanisms.

Detection Engineering

YARA Rule

rule CVE_2024_30375_KeyShot_UAF {
    meta:
        description = "Detects malicious KSP files exploiting CVE-2024-30375"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-30375"
    strings:
        $magic = { 4B 53 50 } // "KSP" magic bytes
        $suspicious = { 00 00 00 00 } // Placeholder for exploit pattern
    condition:
        $magic at 0 and #suspicious > 5
}

Sigma Rule

title: Potential Exploitation of CVE-2024-30375 via KeyShot Viewer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects KeyShot Viewer crashes or abnormal behavior indicative of UAF exploitation
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\keyshot_viewer.exe'
        EventID: 4688
    condition: selection
falsepositives:
    - Legitimate crashes due to corrupted files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30375 KeyShot Viewer KSP File Download"; flow:to_server,established; content:"|4B 53 50|"; depth:3; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Disable or uninstall Luxion KeyShot Viewer until a patch is released.
• Implement strict file execution policies to prevent opening untrusted KSP files.
• Use application sandboxing (e.g., Windows Sandbox, Firejail) to isolate the viewer.

Long-Term Fix:

• Await an official patch from Luxion. Monitor their security advisories.
• Consider using alternative 3D viewing software that is actively maintained.

Workarounds:

• Configure email gateways to block KSP attachments.
• Educate users about the risks of opening unsolicited files.

Valters IT
Securing Digital Frontiers