CVE-2024-7511

Executive Summary

CVE-2024-7511 is a low-severity (CVSS 3.3) information disclosure vulnerability affecting Trimble SketchUp Pro. The flaw resides in the parsing of PSD (Photoshop Document) files embedded within SKP (SketchUp) files. Due to improper validation of user-supplied data, an out-of-bounds read can occur, potentially leaking sensitive memory contents. Exploitation requires user interaction—the victim must open a malicious SKP file or visit a crafted page. While the direct impact is limited to information disclosure, this vulnerability could be chained with other bugs to achieve arbitrary code execution. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector: Local (requires opening a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low (information disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. The vulnerability is not remotely exploitable without user interaction and only leaks memory data. However, in conjunction with other vulnerabilities, it could be part of a multi-stage attack.

Deep Dive & Mechanics

The vulnerability exists in the PSD file parser component of Trimble SketchUp Pro. When an SKP file containing an embedded PSD image is opened, the parser fails to properly validate the bounds of user-supplied data. Specifically, the parser reads from a buffer without ensuring that the read operation stays within the allocated memory region. This results in an out-of-bounds read, which can expose adjacent memory contents.

Root Cause: Lack of proper validation of the PSD file's data length or offset fields before performing memory read operations.

Attack Vector: An attacker crafts a malicious SKP file containing a specially crafted PSD image. The PSD file includes manipulated header fields (e.g., image height, width, or channel data) that cause the parser to read beyond the allocated buffer.

Impact: Information disclosure of heap memory, which may contain sensitive data such as credentials, encryption keys, or other file contents. While not directly leading to code execution, this information can be used to bypass ASLR or leak secrets.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code likely resides in the PSD parsing routine, where a buffer size check is missing or insufficient.

Vulnerable Code (Conceptual):

void parse_psd_data(char *buffer, size_t buffer_size, PSDHeader *header) {
    // No bounds check on header->data_offset
    char *data = buffer + header->data_offset;
    // Out-of-bounds read if data_offset > buffer_size
    process_image_data(data, header->data_length);
}

Patched Code (Expected):

void parse_psd_data(char *buffer, size_t buffer_size, PSDHeader *header) {
    if (header->data_offset + header->data_length > buffer_size) {
        // Handle error
        return;
    }
    char *data = buffer + header->data_offset;
    process_image_data(data, header->data_length);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Trimble SketchUp Pro (vulnerable version).
2. Create a malicious SKP file with an embedded PSD that has a manipulated data_offset field pointing beyond the buffer.
3. Host the file on a web server or deliver via email.

Exploitation Steps:

1. Craft the PSD file using a hex editor or custom script.
2. Embed the PSD into an SKP file using SketchUp's API or manual file manipulation.
3. Deliver the SKP file to the target.
4. When the target opens the file, the out-of-bounds read occurs, leaking memory contents.
5. Capture the leaked data via a debugger or by analyzing the application's output.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor for unusual file open operations involving SKP files from untrusted sources.
• Use endpoint detection and response (EDR) to detect out-of-bounds read exceptions in SketchUp Pro.
• Analyze network traffic for downloads of SKP files from suspicious domains.

Hunting:

• Search for processes (SketchUp.exe) with access violations or memory read errors.
• Look for child processes or threads that crash with STATUS_ACCESS_VIOLATION.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples)
• File Paths: *.skp files with embedded PSD data
• Network: Downloads from untrusted sources
• Process: SketchUp.exe with abnormal memory access patterns
• Registry: N/A

Detection Engineering

YARA Rule

rule CVE_2024_7511_PSD_OOB_Read {
    meta:
        description = "Detects malicious SKP files with PSD data that may trigger CVE-2024-7511"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7511"
    strings:
        $skp_magic = { FF FE 00 00 53 4B 50 } // SKP file magic bytes (example)
        $psd_magic = { 38 42 50 53 } // "8BPS" PSD magic
        $suspicious_offset = { [0-3] FF FF FF FF } // Potential out-of-bounds offset
    condition:
        $skp_magic at 0 and $psd_magic and #suspicious_offset > 0
}

Sigma Rule

title: CVE-2024-7511 - Trimble SketchUp Pro PSD Parsing OOB Read
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-7511 via abnormal SketchUp process behavior
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\SketchUp.exe'
        CommandLine|contains: '.skp'
    condition: selection
falsepositives:
    - Legitimate use of SketchUp with SKP files
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7511 - Potential SKP file download"; flow:to_client,established; file.name:/\.skp$/i; content:"8BPS"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Patch: No official patch available. Monitor Trimble's security advisories for updates.
• Mitigation:
  • Do not open SKP files from untrusted sources.
  • Use application whitelisting to prevent SketchUp from executing untrusted files.
  • Implement endpoint protection that monitors for out-of-bounds memory access.
  • Educate users about the risks of opening unsolicited files.
• Workaround: Disable PSD file parsing if possible (not configurable in current versions).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert