CVE-2024-1624: 3DEXPERIENCE Platform RCE Vulnerability

CVE-2024-1624 Overview

CVE-2024-1624 is a critical OS Command Injection vulnerability affecting the documentation server component across multiple Dassault Systèmes products, including 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight, and CATIA Composer. The vulnerability allows remote attackers to execute arbitrary commands on affected systems by sending specially crafted HTTP requests to the documentation server endpoint.

Critical Impact

This vulnerability enables unauthenticated remote attackers to execute arbitrary operating system commands, potentially leading to complete system compromise, data theft, and lateral movement within enterprise environments.

Affected Products

• 3DEXPERIENCE from Release R2022x through Release R2024x
• SIMULIA Abaqus from Release 2022 through Release 2024
• SIMULIA Isight from Release 2022 through Release 2024
• CATIA Composer from Release R2023 through Release R2024

Discovery Timeline

• 2024-03-01 - CVE-2024-1624 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1624

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The documentation server component in the affected Dassault Systèmes products fails to properly sanitize user-supplied input before incorporating it into operating system commands.

The documentation server accepts HTTP requests that include user-controlled parameters. When these parameters are processed, the application constructs system commands without adequate input validation or sanitization. An attacker can inject malicious command separators and additional commands that the server will execute with the same privileges as the documentation server process.

The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous for organizations exposing these services. Successful exploitation can result in unauthorized system access, data exfiltration, malware deployment, or use of the compromised system as a pivot point for further attacks within the network.

Root Cause

The root cause of CVE-2024-1624 is insufficient input validation and sanitization in the documentation server's HTTP request handling logic. The application fails to properly neutralize special characters and command separators (such as ;, |, &, and backticks) before passing user input to system command execution functions. This allows attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the documentation server endpoint. The malicious payload typically includes command injection sequences embedded within request parameters. When the server processes this request, it inadvertently executes the injected commands with the privileges of the server process.

Typical exploitation involves injecting shell metacharacters followed by malicious commands. For example, parameters intended for documentation retrieval can be manipulated to include command separators that cause the server to execute attacker-controlled commands alongside or instead of the intended operations.

Detection Methods for CVE-2024-1624

Indicators of Compromise

• Unusual HTTP requests to documentation server endpoints containing shell metacharacters (;, |, &, backticks, $())
• Unexpected child processes spawned by the documentation server process
• Anomalous network connections originating from documentation server systems
• Evidence of command execution in web server or application logs with suspicious payloads

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect OS command injection patterns in HTTP requests
• Monitor documentation server access logs for requests containing shell metacharacters and command injection payloads
• Implement endpoint detection and response (EDR) solutions to identify suspicious process chains originating from web server processes
• Use network intrusion detection systems (IDS) to identify exploitation attempts targeting documentation server endpoints

Monitoring Recommendations

• Enable verbose logging on documentation server components and centralize logs for analysis
• Configure alerts for HTTP requests to documentation endpoints containing potentially malicious characters
• Monitor for unusual process execution patterns, particularly shell processes spawned by web application processes
• Track outbound network connections from documentation server systems to identify potential command-and-control communications

How to Mitigate CVE-2024-1624

Immediate Actions Required

• Review the 3DS Security Advisories for official patches and guidance
• Restrict network access to documentation server endpoints using firewall rules to limit exposure
• Implement web application firewall rules to block requests containing command injection patterns
• Audit systems for signs of compromise if the documentation server has been exposed to untrusted networks

Patch Information

Dassault Systèmes has published security advisories regarding this vulnerability. Organizations should consult the official 3DS Security Advisories page to obtain the latest patches for their specific product versions. Apply security updates to all affected installations of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight, and CATIA Composer.

Workarounds

• Disable or restrict access to the documentation server component if not required for operations
• Implement network segmentation to isolate affected systems from untrusted networks
• Deploy a reverse proxy with strict input validation to filter malicious requests before they reach the documentation server
• Use application-level allowlisting to restrict acceptable input patterns for documentation server requests

# Example: Restrict access to documentation server using iptables
# Allow only trusted internal networks to access the documentation server port
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP