1. What is this vulnerability and why does it matter?

This vulnerability (CVE-2022-39806) is a Remote Code Execution (RCE) flaw found in SAP 3D Visual Enterprise Author, specifically version 9. It stems from a lack of proper memory management, which can lead to a stack-based overflow or the reuse of a dangling pointer when a user opens a specially crafted SolidWorks Drawing (.slddrw) file. This is critical because RCE vulnerabilities allow an attacker to execute arbitrary code on the victim's system, potentially leading to complete system compromise, data theft, or further network penetration.

2. What are the CVSS score, severity level, and disclosure details?

The CVSS score for this vulnerability is 7.8. This indicates a High severity level. The vulnerability was publicly published on October 11, 2022, and was last modified on August 3, 2024.

3. Which products, vendors, systems, and versions are affected?

• Vendor: SAP
• Product: SAP 3D Visual Enterprise Author
• Versions Affected: version 9
• Systems: Systems where SAP 3D Visual Enterprise Author - version 9 is installed and used to open SolidWorks Drawing files (e.g., Windows operating systems).

4. What is the technical root cause and attack vector?

The technical root cause is a lack of proper memory management within the CoreCadTranslator.exe component of SAP 3D Visual Enterprise Author. This deficiency can lead to:

• A stack-based buffer overflow (CWE-119)
• The reuse of a dangling pointer which refers to overwritten memory space (CWE-787)

The attack vector involves a victim opening a manipulated SolidWorks Drawing (.slddrw) file. This file, received from an untrusted source, contains a malicious payload designed to exploit the memory management flaws.

5. How can this vulnerability be exploited?

Exploitation occurs when an attacker crafts a malicious SolidWorks Drawing (.slddrw) file. This file, when opened by a victim using SAP 3D Visual Enterprise Author - version 9, triggers the memory corruption vulnerability (either a stack-based overflow or a dangling pointer reuse). The malicious payload embedded within the file can then force the execution of arbitrary code on the victim's system, leading to Remote Code Execution. The primary method of delivery for such a file would likely be via social engineering, such as phishing emails or malicious websites.

7. How can vulnerable systems be detected?

Vulnerable systems can be detected by identifying installations of SAP 3D Visual Enterprise Author. Specifically, any instance running version 9 of the software is susceptible. Organizations should maintain an accurate software inventory to easily identify all installations of this product and their respective versions.

10. What public intelligence references and advisories exist?

• CVE ID: CVE-2022-39806
• CWE IDs: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write)

11. What is the risk assessment and urgency level?

Risk Assessment: The risk associated with CVE-2022-39806 is High. With a CVSS score of 7.8 and the potential for Remote Code Execution (RCE), successful exploitation could lead to full compromise of the affected system. This includes unauthorized access, data manipulation, privilege escalation, and lateral movement within the network.

Urgency Level: The urgency level is High. Organizations using SAP 3D Visual Enterprise Author version 9 should prioritize addressing this vulnerability immediately. Given that exploitation relies on user interaction (opening a malicious file), security awareness training is also crucial to reduce the likelihood of successful social engineering attacks.