CVE-2024-3299

Executive Summary

CVE-2024-3299 is a critical vulnerability affecting Dassault Systèmes eDrawings, specifically within the SOLIDWORKS ecosystem from Release 2023 through Release 2024. The vulnerability is a composite of three distinct memory corruption flaws: an Out-Of-Bounds Write (CWE-787), Use of Uninitialized Resource (CWE-908), and Use-After-Free (CWE-416). These flaws reside in the file reading procedure when processing specially crafted SLDDRW (drawing) or SLDPRT (part) files.

An attacker can exploit this vulnerability by convincing a user to open a malicious file, leading to arbitrary code execution in the context of the affected application. The CVSS v3.1 base score is 7.8 (High), with the attack vector being local and requiring user interaction. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the technical severity remains high due to the potential for full system compromise.

This vulnerability was split from CVE-2024-1847, suggesting a broader initial disclosure that was later refined. No public proof-of-concept (PoC) code or patch details are currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary commercial application (Dassault Systèmes eDrawings) distributed through official vendor channels. Organizations using SOLIDWORKS or eDrawings should treat this as a high-priority supply chain risk, as the vulnerable component is a trusted part of the engineering workflow. Attackers could compromise the software supply chain by injecting malicious files into shared project repositories, email attachments, or cloud storage used by engineering teams.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions required beyond opening the file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full denial of service or system takeover possible.

Threat Level: High. While no active exploitation is reported, the combination of memory corruption flaws and the lack of a patch makes this a significant risk for organizations using the affected software versions.

Deep Dive & Mechanics

The vulnerability is a trifecta of memory safety issues triggered during the parsing of SLDDRW and SLDPRT files. The eDrawings file reader fails to properly validate data structures, leading to:

1. Out-Of-Bounds Write (CWE-787): The reader writes data beyond the allocated buffer boundary, corrupting adjacent memory. This can overwrite critical data structures or function pointers.
2. Use of Uninitialized Resource (CWE-908): The reader uses memory that has not been initialized, potentially containing attacker-controlled data from a previous allocation.
3. Use-After-Free (CWE-416): The reader accesses memory after it has been freed, allowing an attacker to control the freed memory and hijack execution flow.

These flaws are likely chained together. For example, an uninitialized pointer could be used to write out-of-bounds, or a use-after-free could be triggered by a specific sequence of file operations. The attacker crafts a malicious file that triggers these conditions in a controlled manner, ultimately achieving arbitrary code execution.

The vulnerability is triggered during the file reading procedure, which is a core component of eDrawings. This suggests the issue is in the parsing logic for geometric or metadata structures within the file format.

Vulnerable vs. Patched Code

No patch is currently available. The following is a hypothetical comparison based on common remediation patterns for such vulnerabilities.

Vulnerable Code (Hypothetical C++):

// Vulnerable: No bounds checking on index
void ReadData(char* buffer, int index) {
    char* data = new char[64];
    // Use of uninitialized data
    int size = uninitializedSize; // CWE-908
    // Out-of-bounds write
    data[index] = buffer[0]; // CWE-787
    // Use-after-free
    delete[] data;
    data[0] = buffer[1]; // CWE-416
}

Patched Code (Hypothetical C++):

// Patched: Proper initialization and bounds checking
void ReadData(char* buffer, int index) {
    char* data = new char[64](); // Zero-initialized
    if (index >= 0 && index < 64) {
        data[index] = buffer[0];
    } else {
        // Handle error
        delete[] data;
        return;
    }
    // No use-after-free
    delete[] data;
    data = nullptr; // Prevent dangling pointer
}

Exploitation & Lab Setup

Red Team

Objective: Achieve arbitrary code execution on a target system by delivering a malicious SLDDRW or SLDPRT file.

Prerequisites:

• A target running SOLIDWORKS 2023 or 2024 with eDrawings installed.
• Ability to deliver the malicious file (e.g., email, shared drive, USB).

Steps:

1. Craft Malicious File: Use a fuzzer (e.g., AFL++ or libFuzzer) to generate a malformed SLDDRW file that triggers the memory corruption. Alternatively, reverse-engineer the file format using a tool like 010 Editor with a binary template.
2. Deliver Payload: Embed shellcode or a DLL payload within the file. The payload should be designed to execute upon successful exploitation (e.g., a reverse shell or beacon).
3. Trigger Exploit: Send the file to the victim and convince them to open it with eDrawings.
4. Post-Exploitation: Once code execution is achieved, escalate privileges and move laterally.

Example Payload (Shellcode):

; x64 Windows reverse shell shellcode (placeholder)
; Replace with actual shellcode
xor rcx, rcx
mov rcx, 0x12345678 ; IP address
; ... rest of shellcode

Blue Team

Objective: Detect and prevent exploitation attempts.

Detection Strategy:

• Monitor for anomalous file access patterns to eDrawings.
• Use endpoint detection and response (EDR) to detect memory corruption indicators (e.g., access violations, heap spray).
• Implement application whitelisting to prevent untrusted eDrawings executables.

Lab Setup:

• Deploy a Windows 10/11 VM with SOLIDWORKS 2024 and eDrawings.
• Enable Sysmon and Windows Event Logging.
• Use a tool like Process Monitor to observe file access and process behavior.

Testing:

• Open a benign SLDDRW file to establish a baseline.
• Open a crafted malicious file (in a sandboxed environment) and observe:
  • Event ID 1000 (Application Error) in Windows Event Viewer.
  • Sysmon Event ID 11 (FileCreate) for dropped payloads.
  • Network connections to unknown IPs.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder – to be updated when PoC is public)
  • e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 (Malicious SLDDRW)
  • a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (Malicious SLDPRT)
• File Names:
  • malicious_drawing.slddrw
  • malicious_part.sldprt
• Network Indicators:
  • Outbound connections to IP 192.168.1.100 on port 4444 (example C2).
• Process Indicators:
  • eDrawings.exe crashing with exception code 0xc0000005 (Access Violation).
  • Child processes spawned by eDrawings.exe (e.g., cmd.exe, powershell.exe).
• Registry Keys:
  • HKLM\SOFTWARE\Dassault Systemes\eDrawings\... (unusual modifications).

Detection Engineering

YARA Rule

rule CVE_2024_3299_Malicious_SLDDRW {
    meta:
        description = "Detects malicious SLDDRW files exploiting CVE-2024-3299"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3299"
        hash = "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2"
    strings:
        $s1 = { 48 8B 45 08 48 8B 40 20 }  // Example: mov rax, [rbp+8]; mov rax, [rax+20h]
        $s2 = { FF 50 10 }                  // Example: call [rax+10h]
        $s3 = "SLDDRW"                      // File type identifier
        $s4 = { 00 00 00 00 00 00 00 00 }  // Uninitialized data pattern
    condition:
        uint32(0) == 0x52444453 and // "SDDR" magic bytes
        any of ($s*) and
        filesize < 10MB
}

Sigma Rule

title: CVE-2024-3299 eDrawings Memory Corruption Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-3299 via eDrawings crashes or anomalous behavior.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3299
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\eDrawings.exe'
        CommandLine|contains: '.slddrw' or '.sldprt'
    crash:
        EventID: 1000
        Provider_Name: 'Application Error'
        Data|contains: 'eDrawings.exe'
    condition: selection and crash
falsepositives:
    - Legitimate crashes due to file corruption
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-3299 eDrawings Malicious File Download"; flow:to_server,established; content:"SLDDRW"; http_uri; content:".slddrw"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect systems running SOLIDWORKS 2023/2024 from untrusted networks if possible.
2. User Awareness: Train users not to open SLDDRW or SLDPRT files from untrusted sources.
3. File Blocking: Use email and web gateways to block .slddrw and .sldprt attachments from external senders.

Long-Term Actions:

1. Apply Patch: Monitor Dassault Systèmes for an official patch. Apply as soon as available.
2. Upgrade: Consider upgrading to a patched version of SOLIDWORKS or eDrawings when released.
3. Application Control: Use AppLocker or similar to restrict execution of eDrawings to trusted users only.
4. Network Segmentation: Place engineering workstations on a separate VLAN with restricted internet access.

Workaround:

• If patching is not possible, consider using a sandbox or virtual machine to open all SLDDRW/SLDPRT files from external sources.

Valters IT