CVE-2024-3298

Executive Summary

CVE-2024-3298 is a critical memory corruption vulnerability affecting Dassault Systèmes eDrawings, specifically within the file reading procedure for DWG and DXF formats. The vulnerability is a combination of an Out-Of-Bounds Write (CWE-787) and a Type Confusion (CWE-843) flaw. An attacker can exploit this by crafting a malicious DWG or DXF file and enticing a user to open it with an affected version of eDrawings (SOLIDWORKS 2023 through 2024). Successful exploitation leads to arbitrary code execution in the context of the current user. This CVE was split from CVE-2024-1847, indicating a more granular identification of the root cause. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, suggesting low active exploitation in the wild at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary desktop application (eDrawings) distributed by Dassault Systèmes. The risk is primarily to end-users who open untrusted DWG/DXF files, often in engineering, manufacturing, and design supply chains. Organizations should treat any incoming DWG/DXF files from external partners as potentially malicious until a patch is applied.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must deliver the malicious file to the target system.
• Attack Complexity (AC): Low (L) – No special conditions are required to trigger the vulnerability.
• Privileges Required (PR): None (N) – The attacker does not need any prior access.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: High. While no active exploitation is reported, the ease of exploitation (user opens a file) and the high impact (RCE) make this a priority for patching once available.

Deep Dive & Mechanics

The vulnerability resides in the file parsing engine of eDrawings when processing DWG and DXF files. The core issue is a combination of two memory safety flaws:

1. Out-Of-Bounds Write (CWE-787): The parser fails to properly validate the size of data being written to a buffer when reading specific record types within the DWG/DXF file structure. An attacker can supply a malformed record with a manipulated length field, causing the parser to write data beyond the allocated buffer boundary. This corrupts adjacent memory regions.

2. Type Confusion (CWE-843): The parser incorrectly interprets the type of an object or data structure within the file. By providing a crafted object with a mismatched type identifier, the attacker can cause the parser to treat one data type as another (e.g., treating an integer as a pointer). This can lead to reading or writing memory at attacker-controlled addresses.

The combination allows an attacker to bypass standard memory protections. The out-of-bounds write can be used to corrupt a function pointer or a return address, while the type confusion can be used to redirect execution flow to attacker-controlled shellcode. The attack is triggered during the file reading procedure, likely when the parser encounters a specific sequence of bytes in the DWG/DXF binary format.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the vulnerability type, the fix would likely involve:

• Vulnerable Code (Conceptual):

  // Pseudo-code for vulnerable parsing
  void parse_record(FILE *file, Record *rec) {
      uint32_t data_length;
      fread(&data_length, sizeof(data_length), 1, file);
      // VULNERABLE: No check on data_length
      char *buffer = (char*)malloc(256);
      fread(buffer, 1, data_length, file); // Out-of-bounds write if data_length > 256
      // Type confusion: assuming rec->type is always valid
      if (rec->type == 0x01) {
          process_as_point(buffer);
      } else if (rec->type == 0x02) {
          process_as_string(buffer); // But buffer might be treated as a different type
      }
  }
  

• Patched Code (Conceptual):

  // Pseudo-code for patched parsing
  void parse_record(FILE *file, Record *rec) {
      uint32_t data_length;
      fread(&data_length, sizeof(data_length), 1, file);
      // FIX: Validate data_length against a maximum expected size
      if (data_length > MAX_RECORD_SIZE) {
          // Handle error, reject file
          return;
      }
      char *buffer = (char*)malloc(data_length + 1); // Allocate exact size
      fread(buffer, 1, data_length, file);
      // FIX: Validate type before processing
      if (rec->type == 0x01) {
          process_as_point(buffer);
      } else if (rec->type == 0x02) {
          process_as_string(buffer);
      } else {
          // Unknown type, reject
          free(buffer);
          return;
      }
  }
  

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target system with eDrawings (SOLIDWORKS 2023 or 2024) installed.
• Ability to deliver a malicious DWG/DXF file (e.g., via email, USB, or file share).

Exploitation Steps:

1. Craft Malicious File: Use a fuzzer (e.g., AFL, WinAFL) or manual binary editing to create a DWG/DXF file that triggers the out-of-bounds write and type confusion. The specific offsets and record types are not publicly documented, but the attack would involve:
   • Setting a record length field to a value larger than the expected buffer size.
   • Including a type identifier that does not match the actual data structure.
   • Embedding shellcode in the file data that will be written to a predictable memory location.
2. Deliver File: Send the crafted file to the victim via email, a download link, or physical media.
3. Execute: Convince the victim to open the file with eDrawings.
4. Achieve RCE: Upon opening, the vulnerability triggers, overwriting a critical memory structure (e.g., a function pointer in the Import/Export module). The type confusion ensures that execution is redirected to the embedded shellcode, granting the attacker a reverse shell or other payload.

Example (Conceptual - No Public PoC):

# Conceptual Python script to craft a malicious DWG file
import struct

def craft_malicious_dwg():
    # DWG header (simplified)
    header = b'\x41\x43\x31\x30\x32\x34'  # AC1024
    # Malformed record
    record_type = 0x01
    fake_length = 0xFFFF  # Large value to cause overflow
    shellcode = b'\x90' * 1000  # NOP sled + shellcode
    payload = struct.pack('<H', record_type) + struct.pack('<I', fake_length) + shellcode
    with open('malicious.dwg', 'wb') as f:
        f.write(header + payload)

craft_malicious_dwg()

Blue Team (Defense & Detection)

Detection:

• Monitor for eDrawings processes (eDrawings.exe) crashing or exhibiting unusual memory access patterns.
• Use endpoint detection and response (EDR) tools to alert on WriteProcessMemory or VirtualAlloc calls from eDrawings.
• Deploy file reputation services to block known malicious DWG/DXF hashes.

Prevention:

• Isolation: Run eDrawings in a sandboxed environment (e.g., Windows Sandbox, Firejail) when opening files from untrusted sources.
• File Scanning: Use antivirus/EDR with advanced heuristics to scan DWG/DXF files before opening.
• User Training: Educate users not to open DWG/DXF files from unknown or unexpected sources.
• Application Control: Use AppLocker or WDAC to restrict which executables can run.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (No known samples, but monitor for any DWG/DXF files with unusual sizes or structures)
• Process Names: eDrawings.exe, eDrawingsViewer.exe
• Network Connections: Outbound connections from eDrawings to unknown IPs (potential reverse shell)
• Registry Keys: Unusual modifications under HKEY_CURRENT_USER\Software\Dassault Systemes\eDrawings
• File System: Creation of temporary files in %TEMP% with .dll or .exe extensions by eDrawings
• Memory Artifacts: Presence of shellcode patterns (e.g., NOP sleds) in the memory space of eDrawings

Detection Engineering

YARA Rule

rule CVE_2024_3298_Malicious_DWG_DXF {
    meta:
        description = "Detects potentially malicious DWG/DXF files targeting CVE-2024-3298"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3298"
    strings:
        $dwg_header = "AC10"  // DWG header magic bytes
        $dxf_header = "AutoCAD"  // DXF header
        $suspicious_length = { FF FF 00 00 }  // Potential large length field (little-endian 0xFFFF)
        $nop_sled = { 90 90 90 90 90 90 90 90 }
    condition:
        (($dwg_header at 0 or $dxf_header at 0) and $suspicious_length) or
        ($nop_sled and ($dwg_header at 0 or $dxf_header at 0))
}

Sigma Rule

title: CVE-2024-3298 - eDrawings Memory Corruption Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-3298 via eDrawings process behavior
author: Valters IT
date: 2024-10-27
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\eDrawings.exe'
        CommandLine|contains: '.dwg' or '.dxf'
    filter:
        ParentImage|endswith: '\\explorer.exe'  # Normal user double-click
    condition: selection and not filter
falsepositives:
    - Legitimate opening of DWG/DXF files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3298 - Potential eDrawings Outbound Connection After Exploitation"; flow:to_server,established; content:"|90 90 90 90|"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, block all incoming DWG and DXF files at the email gateway or web proxy until a patch is available.
2. Monitor: Deploy the YARA and Sigma rules above to detect malicious files and exploitation attempts.
3. Sandbox: Require that all DWG/DXF files be opened in a sandboxed environment (e.g., using Windows Sandbox or a dedicated VM).

Long-Term Fix:

• Apply Patch: Monitor Dassault Systèmes security advisories for an official patch. Apply it as soon as it is released.
• Upgrade: Consider upgrading to a version of SOLIDWORKS/eDrawings beyond 2024 if a fix is included in a later release.
• Alternative Viewer: Use a different, less targeted DWG/DXF viewer until the vulnerability is resolved.

Workaround:

• Disable the file association for DWG/DXF files with eDrawings temporarily.
• Use Group Policy to block execution of eDrawings.exe from untrusted locations.

Valters IT
DevSecOps & Cyber Threat Intelligence Division