CVE-2024-9728

Executive Summary

CVE-2024-9728 is a critical Use-After-Free (UAF) vulnerability in Trimble SketchUp Viewer, a widely used 3D modeling application. The flaw resides in the parsing of SKP files, where the application fails to validate the existence of an object before performing operations on it. This allows an attacker to craft a malicious SKP file that, when opened by a user, triggers a use-after-free condition, leading to remote code execution (RCE) in the context of the current process. The vulnerability requires user interaction (opening a malicious file or visiting a malicious page), and has a CVSS score of 7.8 (High). No public exploit or patch is currently available, but the risk is significant due to the prevalence of SketchUp in architecture, engineering, and construction industries.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Trimble SketchUp Viewer) and is distributed via official channels. The supply chain risk is limited to the distribution of malicious SKP files through email, web downloads, or shared project files.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although user interaction is required, the vulnerability can be exploited via social engineering (e.g., phishing with a malicious SKP file). Successful exploitation grants full code execution in the user's context, allowing data theft, malware installation, or lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic Use-After-Free (CWE-416) in the SKP file parser of Trimble SketchUp Viewer. SKP files are binary format files containing 3D model data, including geometry, materials, and metadata. The parser processes these files by allocating objects in memory and referencing them via pointers.

Root Cause: When parsing a specially crafted SKP file, the parser may free a memory object (e.g., a geometry node or material) but later attempt to access that same object without checking if it still exists. This results in a dangling pointer, which an attacker can control by manipulating heap memory layout.

Exploitation Flow:

1. Attacker crafts a malicious SKP file that triggers a free operation on a specific object.
2. The attacker then allocates controlled data (e.g., via heap spray) to occupy the freed memory.
3. When the parser dereferences the dangling pointer, it executes attacker-controlled data as code (e.g., via a virtual function table pointer).
4. This leads to arbitrary code execution in the context of the SketchUp Viewer process.

Technical Details:

• The vulnerability was reported via ZDI (ZDI-CAN-24112).
• No patch has been released by Trimble as of this writing.
• The flaw is similar to other UAF vulnerabilities in file parsers (e.g., CVE-2023-XXXX in other CAD software).

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the vulnerability description, the patched code would include a check for object validity before dereferencing.

Vulnerable Code (Conceptual):

void ParseSKPObject(DataStream& stream) {
    Object* obj = new Object();
    // ... parse object data ...
    // Some condition causes obj to be freed
    delete obj;
    // Later, obj is used again without checking
    obj->Process();  // Use-After-Free
}

Patched Code (Conceptual):

void ParseSKPObject(DataStream& stream) {
    Object* obj = new Object();
    // ... parse object data ...
    // Some condition causes obj to be freed
    delete obj;
    obj = nullptr;  // Set to null after free
    // Later, check before use
    if (obj != nullptr) {
        obj->Process();
    }
}

The patched version would also include additional validation of object lifetimes and reference counting to prevent premature freeing.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Trimble SketchUp Viewer (any version prior to patch)
• A malicious SKP file crafted to trigger the UAF
• Knowledge of heap layout and object sizes

Exploitation Steps:

1. Craft Malicious SKP File: Use a binary file editor or custom script to modify a legitimate SKP file. The file must contain a sequence that triggers a free on a specific object (e.g., a material or component) and then reuses it.
2. Heap Spray: Allocate controlled data (e.g., a fake virtual function table) in the freed memory region. This can be done by including many similar objects in the SKP file.
3. Trigger: Open the malicious SKP file in SketchUp Viewer. The parser will free the target object, then dereference the dangling pointer, executing the attacker's payload.
4. Payload: The payload can be a shellcode that executes a reverse shell, drops malware, or exfiltrates data.

Example Payload (Conceptual):

# Python script to generate a malicious SKP file (simplified)
import struct

def create_malicious_skp():
    # Craft SKP header and objects
    # ... (complex binary format)
    # Trigger UAF and heap spray
    payload = b"\x90" * 1000  # NOP sled
    payload += b"\xcc" * 100  # INT3 breakpoints for testing
    return payload

with open("malicious.skp", "wb") as f:
    f.write(create_malicious_skp())

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor for unusual SKP file downloads or email attachments.
• Use endpoint detection and response (EDR) to detect heap spray patterns or abnormal memory allocations in SketchUp Viewer.
• Enable application whitelisting to prevent execution of untrusted SKP files.

Mitigation:

• Disable automatic opening of SKP files from untrusted sources.
• Use sandboxing or virtualization for SketchUp Viewer when opening files from external sources.
• Apply the patch as soon as Trimble releases it.

Hunting:

• Search for processes (SketchUp.exe) with high memory usage or crashes.
• Analyze crash dumps for signs of UAF (e.g., access to freed memory).

Indicators of Compromise (IOCs)

Note: Specific IOCs are not publicly available due to the lack of a public exploit.

Detection Engineering

YARA Rule

rule CVE_2024_9728_SKP_UAF {
    meta:
        description = "Detects malicious SKP files exploiting CVE-2024-9728"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9728"
    strings:
        $skp_header = { 53 4B 50 00 }  // "SKP" header
        $uaf_pattern = { 48 8B 45 ?? 48 85 C0 74 ?? 48 8B 00 }  // Potential UAF dereference
    condition:
        $skp_header at 0 and $uaf_pattern
}

Sigma Rule

title: CVE-2024-9728 - Trimble SketchUp Viewer SKP UAF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-9728 via malicious SKP files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\SketchUp.exe'
        CommandLine|contains: '.skp'
    condition: selection
falsepositives:
    - Legitimate SKP file openings
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9728 - Potential SKP Malicious File Download"; flow:to_server; content:"SKP"; nocase; fileext:"skp"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Auto-Open: Configure Windows to not automatically open SKP files. Remove the file association if possible.
2. User Awareness: Train users to avoid opening SKP files from untrusted sources, especially via email or unknown websites.
3. Application Sandboxing: Run SketchUp Viewer in a sandboxed environment (e.g., Windows Sandbox, Sandboxie) when opening external files.

Long-Term Fix:

• Monitor Trimble's security advisories for a patch. Apply it immediately upon release.
• Consider using alternative 3D viewers that are actively maintained and patched.

Workaround:

• Convert SKP files to a safer format (e.g., OBJ, STL) using a trusted converter before opening in SketchUp Viewer.

Valters IT - DevSecOps & Cyber Threat Intelligence Report
Report generated on: 2025-04-10
Signature: Valters IT