CVE-2024-13047: Ashlar Cobalt RCE Vulnerability

CVE-2024-13047 Overview

CVE-2024-13047 is a type confusion vulnerability in Ashlar-Vellum Cobalt that enables arbitrary code execution when a user opens a malicious CO file. The flaw resides in the CO file parsing routine, which fails to properly validate user-supplied data before treating it as a specific object type. Exploitation requires user interaction: the target must open a crafted file or visit a malicious page delivering one. Successful exploitation results in code execution in the context of the current process. The Zero Day Initiative tracks this issue as ZDI-CAN-24843 and published advisory ZDI-24-1731.

Critical Impact
An attacker can execute arbitrary code with the privileges of the Cobalt user, leading to full compromise of the confidentiality, integrity, and availability of the affected workstation.

Affected Products

Ashlar-Vellum Cobalt 12.0.1204.90
Ashlar-Vellum Cobalt CAD software (CO file parser component)
Workstations processing untrusted Cobalt project files

Discovery Timeline

2024-12-30 - CVE-2024-13047 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13047

Vulnerability Analysis

The vulnerability is a type confusion condition [CWE-843] in the CO file parser used by Ashlar-Vellum Cobalt. The parser reads structured data from CO files and instantiates objects based on embedded type identifiers. When the parser trusts attacker-controlled fields without validating them against the expected object layout, it operates on memory as though it were a different type. This mismatch enables arbitrary reads, writes, or virtual function dispatch on attacker-controlled data.

Root Cause

The root cause is the lack of proper validation of user-supplied data during CO file deserialization. The parser accepts type tags or size fields from the file and uses them to interpret adjacent memory without confirming the object's actual type. This violates the assumption that on-disk type descriptors match the runtime object model, producing the type confusion.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted .co file through email, a web download, or a file share, and the victim opens it in Cobalt. Because the process runs with the interactive user's privileges, code execution inherits those rights and can be used for persistence, credential theft, or lateral movement. No network authentication is required, and the attack complexity is low once the file is opened.

No public proof-of-concept code is available. Refer to the Zero Day Initiative Advisory ZDI-24-1731 for further technical context.

Detection Methods for CVE-2024-13047

Indicators of Compromise

Unexpected child processes spawned by the Cobalt executable following the opening of a .co file.
CO files arriving from external sources such as email attachments, web downloads, or removable media.
Cobalt process crashes with access violation exceptions during file open, suggesting failed exploit attempts.

Detection Strategies

Monitor for Cobalt spawning shells, script interpreters, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe.
Alert on Cobalt processes performing outbound network connections or writing executables to disk.
Inspect file provenance metadata (Mark-of-the-Web) on .co files opened by users.

Monitoring Recommendations

Collect endpoint process creation, image load, and file write telemetry for hosts running Ashlar-Vellum Cobalt.
Track user-opened CO files sourced from browsers or mail clients and correlate with subsequent process activity.
Retain crash dumps from Cobalt for post-incident analysis of suspected exploitation.

How to Mitigate CVE-2024-13047

Immediate Actions Required

Restrict opening of CO files to those originating from trusted, verified sources.
Apply the latest security update from Ashlar-Vellum as soon as it is available for your Cobalt version.
Run Cobalt under a standard user account rather than an administrative account to limit the blast radius of code execution.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Consult Ashlar-Vellum directly and monitor the Zero Day Initiative Advisory ZDI-24-1731 for updated remediation guidance and fixed versions.

Workarounds

Block inbound .co file attachments at the email gateway when not required for business operations.
Enforce application allowlisting so that Cobalt cannot spawn interpreters or unsigned child binaries.
Educate users to reject unsolicited CAD files and validate the sender before opening design documents.

bash

# Example: block .co attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block Cobalt CO Attachments" \
  -AttachmentExtensionMatchesWords "co" \
  -RejectMessageReasonText "CO file attachments are blocked pending CVE-2024-13047 remediation."