CVE-2023-26389 - Out-of-Bounds Read in Adobe Substance 3D Stager 2..1 — How an Innocent File Could Let Hackers Run Code

Adobe Substance 3D Stager is a popular tool among graphic designers and 3D artists. But did you know that versions 2..1 and earlier come with a critical vulnerability called CVE-2023-26389? This flaw makes it possible for hackers to trick users into running malicious code just by getting them to open a harmful file.

In this post, I’ll walk you through what CVE-2023-26389 is, how it can be exploited, and what you can do to protect yourself.

What is CVE-2023-26389?

CVE-2023-26389 is an out-of-bounds read vulnerability found in Adobe Substance 3D Stager, version 2..1 and earlier. Simply put, if the program tries to read data outside the boundaries of what’s allowed in memory when opening a specially crafted file, it could read errors that let hackers sneak in their own code.

Why does this matter?

If attackers are able to run their own code when you open a file, they can steal your data, install other malware, or even take control of your computer — all under your user account.

Original References

- Adobe Security Bulletin APSB23-20
- NIST NVD Entry for CVE-2023-26389
- MITRE CVE Record

How the Attack Works

1. Attacker Creates Malicious File: The attacker crafts a model or scene file (.stg or similar) designed to exploit the out-of-bounds read vulnerability in Stager.
2. User Opens the File: The victim, trusting the file or not knowing it’s malicious, opens it in Adobe Substance 3D Stager.
3. Triggering the Bug: The vulnerability is triggered as the app tries to read past the end of a memory block. If prepared right, the malicious file takes advantage of this to execute arbitrary code.

A Peek Into a Crafted File (Code Snippet)

While Adobe hasn't revealed exact file formats or vulnerable code, we can share a general example. Imagine part of a binary file format with a defined length, but the file provides less data than expected. The code may look like:

// Hypothetical vulnerable code in C++
void parseMesh(char* data, int length) {
    int vertCount = *(int*)(data);  // Reads expected number of vertices from file
    float *vertices = new float[vertCount * 3];
    memcpy(vertices, data + 4, vertCount * 3 * sizeof(float)); // Unsafe, can read out-of-bounds if vertCount is very large or negative!
}

An attacker could create a file where vertCount is set so high (or negative) that the memcpy reads far outside the allocated memory.

Stage 1: File Creation

- The attacker creates a file that, when processed by Stager, will cause it to read memory past where it should. They might set a length field higher than the file really contains, confusing the program.

Stage 2: Spear-phishing

- The attacker sends you the file, splits it with social engineering—maybe it’s labeled as a new model for your project or a community asset.

Stage 3: Exploitation

- When you load the file, Adobe Substance 3D Stager tries to read the data, triggering the bug. If arranged properly, attacker-controlled data is read and turned into executable code (for example, via a Return-Oriented Programming (ROP) chain).

Stage 4: Shell Access

- The attacker’s code runs under your permissions. Depending on what you’re allowed to do, the attacker could install trojans, ransomware, keyloggers, etc.

This is a mock file header, not real code

// Hypothetical file bytes:
// [04 00 00 00]    # vertCount = 4 (valid)
// [xx xx ...]      # normal vertex data

// Exploit variant:
// [FF FF FF FF]    # vertCount = -1 (huge!)
// [random data]    # attacks the software, as the reader will go past file end

Protection and Mitigation

- Update: The safest fix is upgrading Adobe Substance 3D Stager to version 2.1. or later, where Adobe has patched the vulnerability.
- Be Careful with Files: Don’t open files from strangers or untrusted sources, even if they look like normal 3D assets.

Conclusion

CVE-2023-26389 is a serious but avoidable threat. If you use Adobe Substance 3D Stager, upgrade right away. Even if you’re cautious about email attachments, attackers may find creative methods to get you to open booby-trapped 3D files.

Timeline

Published on: 04/12/2023 22:15:00 UTC