CVE-2024-45150

Executive Summary

CVE-2024-45150 is a critical out-of-bounds write vulnerability affecting Dassault Systèmes Dimension versions 4.0.3 and earlier. This flaw allows an attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. The vulnerability has a CVSS score of 7.8 (High) and requires user interaction for exploitation. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No privileges are needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must open a malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive data is possible.
• Integrity (I): High (H) – Complete compromise of data integrity is possible.
• Availability (A): High (H) – Full denial of service or system crash is possible.

Threat Level: High. While user interaction is required, the potential for full system compromise makes this a critical risk for organizations using the affected software.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in Dassault Systèmes Dimension, a 3D modeling and design application. The flaw likely resides in the parsing of a specific file format (e.g., .3dxml, .stp, or a proprietary format) where the software fails to properly validate the size of an input buffer before writing data to it. An attacker can craft a malicious file that, when opened by a user, causes the application to write data beyond the allocated buffer boundaries. This can corrupt adjacent memory, potentially overwriting function pointers or other critical data structures, leading to arbitrary code execution.

The exploitation process typically involves:

1. Crafting the Malicious File: The attacker creates a file with a specially crafted header or data block that triggers the out-of-bounds write.
2. Social Engineering: The attacker delivers the file to the victim via email, download, or other means, convincing them to open it in Dimension.
3. Triggering the Vulnerability: When the victim opens the file, the vulnerable parsing routine writes data beyond the buffer, corrupting memory.
4. Code Execution: The attacker can control the overwritten data to hijack the execution flow, typically by overwriting a return address or a function pointer, and redirecting execution to shellcode embedded in the file.

Vulnerable vs. Patched Code

Since no patch details are available, a direct code comparison cannot be provided. However, based on the vulnerability type, the patched code would likely include:

• Input Validation: Added checks to ensure that the size of data being written does not exceed the allocated buffer size.
• Bounds Checking: Implementation of safe memory copy functions (e.g., memcpy_s instead of memcpy) that enforce buffer limits.
• Safe String Handling: Use of functions like strncpy or snprintf instead of strcpy or sprintf to prevent buffer overflows.

Example of vulnerable code (pseudo):

void parse_file_data(char *input, int size) {
    char buffer[256];
    // No bounds check
    memcpy(buffer, input, size);
}

Example of patched code (pseudo):

void parse_file_data(char *input, int size) {
    char buffer[256];
    // Bounds check
    if (size > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, input, size);
}

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Achieve arbitrary code execution on a target system running Dimension 4.0.3.

Lab Setup:

• Target: Windows 10/11 with Dassault Systèmes Dimension 4.0.3 installed.
• Attacker: Kali Linux or similar with a Python script to generate the malicious file.

Steps:

1. Identify the Vulnerable Function: Use a fuzzer (e.g., AFL, Boofuzz) to find the exact file format and field that triggers the out-of-bounds write.
2. Craft the Exploit File: Create a malicious file with a crafted header that causes a buffer overflow. For example, if the vulnerability is in parsing a string field, provide a string longer than the expected buffer.
3. Deliver the File: Send the file to the victim via email or a download link.
4. Trigger Exploitation: When the victim opens the file, the exploit executes, spawning a reverse shell or executing arbitrary commands.

Example Python script to generate a malicious file (conceptual):

import struct

# Craft a malicious file with a long string
payload = b"A" * 300  # Overflow buffer
# Add shellcode to execute calc.exe
shellcode = b"\x90" * 20 + b"\x31\xc9\x51\x68\x63\x61\x6c\x63\x54\xb8\xc7\x93\xbf\x77\xff\xd0"
malicious_data = payload + shellcode

with open("malicious.dim", "wb") as f:
    f.write(malicious_data)

Blue Team (Defensive)

Objective: Detect and prevent exploitation of CVE-2024-45150.

Detection:

• Monitor for unusual file opens in Dimension (e.g., files with abnormal sizes or structures).
• Use endpoint detection and response (EDR) tools to detect memory corruption events (e.g., access violations, buffer overflow exceptions).
• Implement application whitelisting to prevent execution of untrusted files.

Prevention:

• Restrict user permissions to prevent installation of vulnerable software versions.
• Use sandboxing or virtualization to isolate the application.
• Deploy network segmentation to limit lateral movement if a system is compromised.

Hunting:

• Search for crash dumps or error logs from Dimension that indicate buffer overflow attempts.
• Analyze network traffic for reverse shell connections originating from systems running Dimension.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (No known malicious files at this time)
• Process Names: dimension.exe (or similar)
• Network Indicators: Outbound connections to unknown IPs on high ports (e.g., 4444, 1337) from the Dimension process.
• Registry Keys: Unusual modifications to HKEY_CURRENT_USER\Software\Dassault Systèmes\Dimension.
• File System: Creation of suspicious files in the user's temporary directory (e.g., %TEMP%\exploit.dll).

Detection Engineering

YARA Rule

rule CVE_2024_45150_Dimension_OOBW {
    meta:
        description = "Detects malicious files targeting CVE-2024-45150 in Dassault Dimension"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "Dassault Systèmes Dimension" wide ascii
        $s2 = { 41 41 41 41 41 41 41 41 } // Pattern of 'A' characters indicating overflow
        $s3 = { 90 90 90 90 90 90 90 90 } // NOP sled
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2024-45150 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-45150 via abnormal file access
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\dimension.exe'
        CommandLine|contains: '.dim'
    condition: selection
falsepositives:
    - Legitimate use of Dimension with .dim files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2024-45150 Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect systems running Dimension 4.0.3 from the network if possible.
2. User Awareness: Educate users not to open files from untrusted sources.
3. Application Control: Use software restriction policies to block execution of Dimension if not required.

Long-Term Fix:

• Patch: Await an official patch from Dassault Systèmes. Monitor their security advisory page for updates.
• Upgrade: Upgrade to a patched version once available.
• Workaround: If patching is not possible, consider using a different 3D modeling tool or running Dimension in a sandboxed environment.

Monitoring:

• Enable detailed logging for process creation and file access.
• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT