CVE-2024-9725

Executive Summary

CVE-2024-9725 is a critical Use-After-Free (UAF) vulnerability in Trimble SketchUp Viewer, a widely used 3D modeling application. The flaw resides in the parsing of SKP files, where the software fails to validate the existence of an object before performing operations on it. This allows an attacker to craft a malicious SKP file that, when opened by a user, triggers a use-after-free condition, leading to remote code execution (RCE) in the context of the current process. The vulnerability requires user interaction (opening a malicious file or visiting a malicious page), but no authentication is needed. With a CVSS score of 7.8, it poses a significant risk to users of Trimble SketchUp Viewer, especially in enterprise environments where such software is used for design and collaboration. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must deliver the malicious file to the target system.
• Attack Complexity (AC): Low (L) – No special conditions required beyond opening the file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious SKP file.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: High. The vulnerability is exploitable with low complexity and no privileges, but requires user interaction. Given the lack of a patch, it is a prime target for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic Use-After-Free (UAF) in the SKP file parsing routine of Trimble SketchUp Viewer. SKP files are binary files containing 3D model data, including geometry, textures, and metadata. The parsing process involves allocating memory for various objects (e.g., vertices, faces, materials) and then referencing them.

The flaw occurs when the parser frees an object (e.g., due to a malformed or duplicate entry) but continues to use a pointer to that freed memory. An attacker can craft an SKP file that triggers this sequence:

1. Allocate object A.
2. Free object A (e.g., via a crafted deletion or overwrite).
3. Allocate object B of the same size (e.g., a controlled data structure) in the freed memory.
4. Use the dangling pointer to object A, which now points to object B.
5. This allows the attacker to control the execution flow, leading to arbitrary code execution.

The vulnerability is in the SKP::Parser module, specifically in the handling of object references. The lack of validation before dereferencing pointers is the root cause.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the fix. The vulnerable code likely looks like:

// Vulnerable code
void ParseObject(Object* obj) {
    // ... parse data ...
    if (obj->type == TYPE_COMPLEX) {
        // Process complex object
        ProcessComplex(obj->data.complex);
    }
    // Free object after processing
    FreeObject(obj);
    // ... later, use obj again without checking
    if (obj->type == TYPE_SIMPLE) {  // Use-after-free!
        // ...
    }
}

A patched version would set the pointer to NULL after freeing and check for NULL before use:

// Patched code
void ParseObject(Object* obj) {
    // ... parse data ...
    if (obj->type == TYPE_COMPLEX) {
        ProcessComplex(obj->data.complex);
    }
    FreeObject(obj);
    obj = NULL;  // Invalidate pointer
    // ... later, check before use
    if (obj != NULL && obj->type == TYPE_SIMPLE) {
        // ...
    }
}

Exploitation & Lab Setup

Red Team

Objective: Achieve remote code execution on a target running Trimble SketchUp Viewer.

Prerequisites:

• A target with Trimble SketchUp Viewer installed (any version).
• Ability to deliver a malicious SKP file (e.g., via email, download, or USB).

Steps:

1. Craft Malicious SKP File: Use a fuzzer (e.g., AFL++) to generate a malformed SKP file that triggers the UAF. Alternatively, reverse-engineer the parsing logic to manually create a file that frees an object and then reuses it.
2. Heap Spray: To control the freed memory, perform a heap spray with a payload (e.g., a ROP chain or shellcode). This can be done by including many objects of the same size in the SKP file.
3. Trigger UAF: The crafted file will cause the parser to free a specific object and then dereference a dangling pointer, which now points to the attacker-controlled heap spray.
4. Code Execution: The controlled data will hijack execution flow (e.g., via a virtual function table pointer) to execute the payload.

Example Payload (Shellcode):

; Windows x64 calc.exe shellcode
xor rcx, rcx
push rcx
mov rdx, 0x6578652e636c6163  ; "calc.exe"
push rdx
mov rdx, rsp
push rcx
push rdx
push rcx
mov r9, rcx
mov r8, rcx
mov rdx, rcx
mov rcx, rcx
mov rax, 0x7ffa12345678  ; Address of WinExec
call rax

Blue Team

Detection:

• Monitor for unusual SKP file downloads or email attachments.
• Use endpoint detection and response (EDR) to detect heap spray patterns (e.g., large allocations of similar size).
• Look for crashes in Trimble SketchUp Viewer (Event ID 1000 in Windows Application Event Log).

Hunting:

• Search for SKP files with anomalous structures (e.g., excessive object references or malformed headers).
• Analyze memory dumps for signs of UAF exploitation (e.g., dangling pointers).

Mitigation:

• Restrict execution of Trimble SketchUp Viewer to trusted users only.
• Use application whitelisting to prevent untrusted SKP files from being opened.
• Enable ASLR and DEP to make exploitation harder.

Indicators of Compromise (IOCs)

• File Hashes: (No known malicious samples yet)
• Network Indicators: None (local file-based exploit)
• Process Indicators:
  • sketchup.exe crash with exception code 0xc0000005 (Access Violation)
  • Unusual child processes spawned by sketchup.exe (e.g., cmd.exe, powershell.exe)
• Registry Keys: (None specific)
• YARA Rule: (See Detection Engineering)

Detection Engineering

YARA Rule

rule CVE_2024_9725_SKP_UAF {
    meta:
        description = "Detects malicious SKP files exploiting CVE-2024-9725"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $header = "SKP" ascii wide nocase
        $uaf_pattern = { 48 8B 45 ?? 48 85 C0 74 ?? 48 8B 40 ?? FF 50 ?? }  // Potential UAF dereference
    condition:
        $header at 0 and #uaf_pattern > 0
}

Sigma Rule

title: CVE-2024-9725 - Trimble SketchUp Viewer UAF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-9725 via process crashes or heap spray
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sketchup.exe'
        CommandLine|contains: '.skp'
    condition: selection
falsepositives:
    - Legitimate SKP file opening
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9725 - Potential SKP file download"; flow:to_server,established; content:"SKP"; nocase; within:4; pcre:"/\.skp$/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SKP file parsing if not required, or restrict opening SKP files to trusted sources only.
2. Use application virtualization (e.g., Sandboxie) to run Trimble SketchUp Viewer in an isolated environment.
3. Monitor for updates from Trimble and apply the patch as soon as it becomes available.

Long-term:

• Implement a file reputation service to block untrusted SKP files.
• Train users to avoid opening SKP files from unknown or untrusted sources.
• Consider using alternative 3D viewers that are actively maintained.

Workaround:

• If possible, convert SKP files to a safer format (e.g., OBJ or STL) before opening.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert