# Exploit Title: PrusaSlicer 2.6.1 – Arbitrary code execution on g-code export
# Date: 16\/01\/2024
# Exploit Author: Kamil Bre\u0144ski
# Vendor Homepage: https:\/\/www.prusa3d.com
# Software Link: https:\/\/github.com\/prusa3d\/PrusaSlicer
# Version: PrusaSlicer up to and including version 2.6.1
# Tested on: Windows and Linux
# CVE: CVE-2023-47268<\/p>\n
==========================================================================================
1.) 3mf Metadata extension
==========================================================================================<\/p>\n
PrusaSlicer 3mf project (zip) archives contain the ‘Metadata\/Slic3r_PE.config’ file which describe various project settings, this is an extension to the regular 3mf file. PrusaSlicer parses this additional file to read various project settings. One of the settings (post_process) is the post-processing script (https:\/\/help.prusa3d.com\/article\/post-processing-scripts_283913) this feature has great potential for abuse as it allows a malicious user to create an evil 3mf project that will execute arbitrary code when the targeted user exports g-code from the malicious project. A project file needs to be modified with a prost process script setting in order to execute arbitrary code, this is demonstrated on both a Windows and Linux host in the following way.<\/p>\n
==========================================================================================
2.) PoC
==========================================================================================<\/p>\n
For the linux PoC, this CLI command is enough to execute the payload contained in the project. ‘.\/prusa-slicer -s code-exec-linux.3mf’. After slicing, a new file ‘\/tmp\/hax’ will be created. This particular PoC contains this ‘post_process’ entry in the ‘Slic3r_PE.config’ file:<\/p>\n
“`
; post_process = “\/usr\/bin\/id > \/tmp\/hax #\\necho ‘Here I am, executing arbitrary code on this host. Thanks for slicing (x_x)’>> \/tmp\/hax #”
“`<\/p>\n
Just slicing the 3mf using the `-s` flag is enough to start executing potentially malicious code.<\/p>\n
For the windows PoC with GUI, the malicious 3mf file needs to be opened as a project file (or the settings imported). After exporting, a pop-up executed by the payload will appear. The windows PoC contains this entry:<\/p>\n
“`
; post_process = “C:\\\\Windows\\\\System32\\\\cmd.exe \/c msg %username% Here I am, executing arbitrary code on this host. Thanks for slicing (x_x) “
“`<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: PrusaSlicer 2.6.1 – Arbitrary code execution on g-code export# Date: 16\/01\/2024# Exploit Author: Kamil Bre\u0144ski# Vendor Homepage: https:\/\/www.prusa3d.com# Software Link: https:\/\/github.com\/prusa3d\/PrusaSlicer# Version: PrusaSlicer up to and including version 2.6.1# Tested on: Windows and Linux# CVE: CVE-2023-47268 ==========================================================================================1.) 3mf Metadata extension========================================================================================== PrusaSlicer 3mf project (zip) archives contain the ‘Metadata\/Slic3r_PE.config’ file which describe various …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56271","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56271"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56271\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}