Orphaned VBA Projects Found in AutoCAD DWG Files
Researchers have identified a peculiar issue where VBA projects are embedded within AutoCAD DWG files but are inaccessible to the software, potentially due to specific AutoLISP commands.
Security researchers have uncovered a novel vulnerability class within AutoCAD drawing files (.dwg), dubbed "orphaned" VBA projects. These projects, which contain executable code, are embedded within the DWG file structure but are rendered inaccessible by AutoCAD itself. This inaccessibility stems from a zeroed-out pointer within the DWG file's header, which normally directs AutoCAD to the location of the embedded OLE file containing the VBA code. Despite the pointer being null, the OLE file itself often remains intact within the DWG.
Normally, AutoCAD relies on a specific pointer, located at offset 0x24 in the DWG file's header, to locate and execute embedded VBA projects. This pointer indicates the start of a 16-byte header followed by the embedded OLE file. However, in the case of these "orphaned" projects, this crucial pointer is set to zero. Consequently, when AutoCAD opens such a DWG file, it does not recognize the presence of the VBA project, and the embedded code cannot be automatically executed. This effectively renders the VBA code inert from AutoCAD's perspective, even though the data is still physically present within the file.
The discovery was made by Didier Stevens, who noted that while his custom Python script (autocad.py) designed to extract embedded OLE files based on the header pointer returned no data for these specific DWG files, a brute-force search for embedded OLE files still revealed the presence of VBA projects. This discrepancy highlights that the issue is not the absence of the VBA code, but rather AutoCAD's inability to find it due to the corrupted or missing pointer.
While the exact mechanism causing these projects to become orphaned is not definitively known, Stevens points to a potential culprit: the AutoLISP command (dictremove (namedobjdict) "ACAD_VBA"). This command is used to remove VBA projects from DWG files. It is theorized that this command might clear the pointer in the DWG header but fail to completely remove the embedded OLE file, thus creating the "orphaned" state.
It is important to note that a standard installation of AutoCAD does not include VBA support; it requires a separate installation. This means that even if a VBA project were properly linked, it would not execute without the VBA module being installed. However, the "orphaned" project issue affects the discoverability of the VBA code regardless of whether VBA is installed.
For security analysts examining DWG files, this finding presents a new avenue for investigation. When using tools like oledump.py to analyze DWG files, it is now recommended to not only look for embedded VBA projects but also to verify that the pointer at offset 0x24 is not zero. If the pointer is zero, and a VBA project is still found, it should be flagged as an "orphaned" project, indicating that it cannot be automatically executed by AutoCAD.
This discovery is significant because it reveals a potential method for embedding malicious VBA code within DWG files that could evade standard detection mechanisms relying on the DWG header pointer. While the code cannot execute automatically, it could potentially be extracted and executed manually or through other means, posing a risk to users who are unaware of the embedded, albeit orphaned, code. Further research may be needed to understand the full implications and potential exploitation vectors of these orphaned VBA projects.