A new and serious security issue has emerged: CVE-2024-11155, a "use after free" vulnerability in Rockwell Automation's Arena® simulation software. This flaw allows cyberattackers to craft a specially designed DOE file that, when opened by a legitimate user, lets the attacker execute arbitrary code on the victim’s computer.

This post gives an exclusive deep dive on what this vulnerability is, how it works, provides simplified code examples, shows how attackers might exploit it, and offers guidance on protecting affected systems.

What is "Use After Free"?

A "use after free" bug happens when an application frees (removes) a chunk of memory, but then tries to use that memory later on. If an attacker can influence what goes into that freed memory spot, they can sometimes control what the program does next, potentially leading to code execution.

Rockwell Automation Arena®

- All Arena versions before see official bulletin for specifics.

How It’s Exploited

The attacker creates a malicious DOE file (Arena’s Design of Experiment file format) that, when loaded, triggers the use-after-free bug. By carefully controlling the contents of the file, the attacker can insert malicious code into memory, which Arena later runs by accident.

Key requirement:
The victim must *open the attacker’s file* for the attack to work.

The DOE file causes Arena to access that memory—now controlled by the attacker.

4. Attacker’s code runs on the victim’s computer—potentially giving remote control or causing data loss.

Vulnerability Example: Use After Free in C++

Let’s illustrate a simplified version of what might be happening under the hood (note: not the real Arena code):

class ResourceHandler {
public:
    char *data;
    ResourceHandler() {
        data = new char[100];
    }
    ~ResourceHandler() {
        delete[] data;
    }
    void UseResource() {
        // ... do something with data
        printf("%s", data);
    }
};

// Somewhere in file processing
ResourceHandler *handler = new ResourceHandler();
delete handler;               // Frees the data
handler->UseResource();       // Use after free!

If an attacker can influence what gets stored at the location of data after it’s been deleted, they might insert their own code. When UseResource() is called, that code could get executed.

Proof-of-Concept (PoC) DOI File

While the exact deforming of a DOE file for Arena® isn’t public, a real-world attacker might create a file with crafted fields:

<!-- Malicious DOE fragment -->
<Experiment>
  <Parameter Name="Name" Value="; calc.exe;"/>
  ...
</Experiment>

If Arena naively processes this file and the bug is present, the resource handling code could be tricked into running the attacker's payload (calc.exe here represents a demonstration, but real attacks use more dangerous code).

Attacker crafts a DOE file that exploits the use-after-free bug.

2. Attacker convinces a legitimate Arena user to open the malicious file (via phishing email or a shared project).

References

- Rockwell Automation Security Advisory PN184
- Mitre CVE database entry
- OWASP: Use After Free
- Background on Use-After-Free (Wikipedia)

Do NOT open DOE files from untrusted sources.

- Update Arena to the latest version immediately—patches for this vulnerability should be available.
- Educate your team: Users should know about phishing and file-based attacks targeting Arena or other engineering tools.

Conclusion

CVE-2024-11155 is a serious vulnerability in Arena®, Rockwell Automation’s popular simulation tool. By exploiting a "use after free" bug in file handling, attackers can execute arbitrary code—potentially taking full control of target systems. The best defense is to apply patches promptly and be wary of opening files from unknown sources.

Stay safe! Share this post with colleagues using Arena to help prevent possible attacks.


*Created exclusively for this post. For questions or further technical breakdown, comment below or contact your security team.*

Timeline

Published on: 12/05/2024 18:15:20 UTC
Last modified on: 12/06/2024 19:15:10 UTC