CVE-2024-45871

Executive Summary

CVE-2024-45871 is a denial-of-service (DoS) vulnerability in Bandisoft BandiView version 7.05. The flaw resides in the sub_0x232bd8 function, where improper access control allows an attacker to crash the application, leading to a denial of service. No CVSS score, EPSS score, or public proof-of-concept (PoC) is available at this time. The vendor has not released a patch, and the vulnerability remains unpatched.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (BandiView) distributed by Bandisoft. Users should verify the integrity of downloaded binaries via official channels and checksums.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No score assigned)
• Attack Vector: Local (requires user interaction to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (due to DoS potential but no public exploit)

Deep Dive & Mechanics

The vulnerability is triggered via the function sub_0x232bd8 in BandiView 7.05. This function likely handles file parsing or rendering. Due to incorrect access control, an attacker can craft a malicious file (e.g., image or document) that, when opened by BandiView, causes the application to crash. The crash results from a memory corruption or infinite loop, leading to a denial of service. No further technical details are publicly available.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code is in sub_0x232bd8 within the BandiView binary. Without a patch, the exact code diff cannot be provided.

Exploitation & Lab Setup

Red Team

1. Setup: Install BandiView 7.05 on a Windows VM.
2. Craft Payload: Create a malformed file (e.g., a corrupted image) that triggers the crash. Since no public PoC exists, fuzzing the file parser may be required.
3. Execute: Open the malicious file with BandiView. The application should crash immediately.
4. Impact: Denial of service – the user cannot use BandiView until it is restarted.

Blue Team

1. Detection: Monitor for crashes of BandiView.exe using Windows Event Logs (Event ID 1000 for application errors).
2. Prevention: Restrict execution of BandiView via AppLocker or WDAC. Use file reputation services to block known malicious files.
3. Response: If a crash is detected, isolate the host and analyze the file that caused the crash. Block the file hash.

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no public PoC)
• Process: BandiView.exe crashing repeatedly
• Event Logs: Windows Application Event Log with Event ID 1000, faulting module BandiView.exe, exception code 0xc0000005 (access violation) or similar.

Detection Engineering

YARA Rule

rule CVE_2024_45871_BandiView_DoS {
    meta:
        description = "Detects files that may trigger CVE-2024-45871 in BandiView 7.05"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-45871"
    strings:
        $magic = { 89 50 4E 47 } // Example: PNG magic bytes (adjust based on actual trigger)
        $crash_pattern = { 0F 0B } // Example: UD2 instruction (crash)
    condition:
        $magic at 0 and $crash_pattern
}

Sigma Rule

title: BandiView Crash Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects BandiView crashes potentially caused by CVE-2024-45871
author: Valters IT
date: 2025-04-14
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Application: 'BandiView.exe'
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45871 BandiView DoS Attempt"; flow:to_server; content:"BandiView"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Patch: No patch available. Monitor Bandisoft's official website for updates.
• Mitigation: Avoid opening untrusted files with BandiView. Use alternative image viewers until a patch is released.
• Workaround: Run BandiView in a sandbox or with reduced privileges to limit impact.

Valters IT
DevSecOps & Cyber Threat Intelligence