Summary
A Code Injection vulnerability in the file ThreeMFReader.py allows attackers to distribute malicious models which will trigger code injection vulnerabilities on vulnerable UltiMaker Cura versions.
Product
This vulnerability affects UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2
Impact
The vulnerability allowing an attacker to execute arbitrary code by crafting a malicious 3MF file.
Steps to reproduce
Anyone can tamper an existing 3MF model to run arbitrary code:
- Extract the 3MF file (which is a ZIP archive).
- Edit the file 3dmodel.model and search for the
drop_to_build(if not exist, re-export the file using Cura). - Add your python payload code and save the file:
__import__('os').system('calc') - Open the file with vulnerable Cura version
Expected result:
The calculator application will be spawned on the machine
Remediation
A fix was released in commit 285a241 for version v5.8.0-beta.1, where the unnecessary eval call was removed with appropriate boolean parsing.
Credit
This issue was discovered and reported by Checkmarx Senior Researcher Ori Ron.
