CVE-2024-51330 --> Unencrypted Inter-Process Communication (IPC) Vulnerability - UltiMaker Cura

CVE_report.txt

=================================================
[1] CVE-2024-51330 --> Unencrypted Inter-Process Communication (IPC) Vulnerability - UltiMaker Cura
=================================================

[Description]
Ultimaker Cura employs unencrypted inter-process communication (IPC) over localhost between its main application and CuraEngine (the slicing process)
using the libArcus protocol on port 49674. This communication involves a bidirectional flow of data essential to the 3D printing process.

Initially, the Cura application sends two types of data to CuraEngine. First, it transmits the mesh data, which is a binary representation of the 
3D model's geometry. While this data is in binary format and not easily interpretable or modifiable in real-time, it is crucial for the slicing process. 
Alongside the mesh data, Cura sends printing settings as plaintext. These settings encompass a wide range of parameters that dictate how the object will be printed.

Upon receiving this data, CuraEngine processes the mesh and applies the printing settings to generate G-code instructions.
These G-code instructions are a set of commands that control the 3D printer's operations. Once generated, CuraEngine sends these G-code 
instructions back to the Cura application as plaintext over the same localhost connection.
This return transmission is also vulnerable to interception and modification.

This design vulnerability allows a local attacker with root privileges to intercept and modify both the plaintext printing settings sent to CuraEngine
and the G-code instructions returned to Cura. Such unauthorized alterations could lead to the production of defective or compromised parts,
equipment damage, or safety hazards. This is particularly critical in industries like aerospace, automotive, or medical device manufacturing where part integrity is crucial.

------------------------------------------

[Vulnerability Type]
Information Disclosure, Design Weakness

------------------------------------------

[Vendor of Product]
Ultimaker

------------------------------------------

[Affected Product Code Base]
UltiMaker Cura - All versions (5.8.1 and earlier)

------------------------------------------

[Affected Component]
- Inter-process communication (IPC) mechanism between Cura and CuraEngine processes.
- Localhost network stack.
- Printing settings and G-code processing components.
------------------------------------------

[Attack Type]
Local 

------------------------------------------

[Impact]
- Information disclosure of printing settings and G-code instructions.
- Potential production of defective 3D printing objects.
- Safety hazards from intentionally weakened printed components.
- Possible intellectual property theft in industrial settings.

------------------------------------------

[Attack Vectors]

- A local attacker with root privileges can intercept and modify unencrypted printing settings and G-code instructions between Cura and CuraEngine processes over localhost (127.0.0.1:49674).
- Using network packet manipulation tools such as iptables and NetfilterQueue, the attacker can perform real-time interception and modification of packets on this specific localhost traffic without detection by the Cura application or the end-user.
- When the user initiates slicing of a 3D STL design file using the Cura application, the attacker can modify critical print parameters or inject malicious G-code commands, producing defective or compromised objects without any indication of tampering in the Cura application interface.

------------------------------------------

[Discoverer]
Hala Ali (Virginia Commonwealth University), Irfan Ahmed (Virginia Commonwealth University)

------------------------------------------

[Reference]
https://github.com/Ultimaker/Cura

------------------------------------------

Additional information
- We developed a proof-of-concept attack to demonstrate the vulnerability in Cura's inter-process communication. 
- The attack utilizes iptables to redirect TCP traffic on the loopback interface (localhost) to a NetFilter Queue, specifically targeting port 49674 used by Cura and CuraEngine. We then employed the NetfilterQueue library in Python to intercept, inspect, and modify packets in real-time.
- When a user initiates the slicing of a 3D STL file, our script intercepts the G-code instructions sent from CuraEngine back to the Cura application. To demonstrate the impact, we injected 'M106 S0' commands at multiple points within the G-code, effectively disabling cooling fans during the printing process.
- This manipulation results in excessive melting of the material during printing, showcasing the potential for severe alterations to both the printing process and the final physical object. The ability to modify printing instructions without detection highlights the critical nature of this vulnerability and its potential real-world impacts on 3D printed objects, especially in applications where structural integrity is crucial.
========================================================================