CVE-2021-27492: 
Homebrew vulnerability analysis and mitigation

The vulnerability (CVE-2021-27492) affects Datakit Software libraries bundled in Luxion KeyShot software, specifically in versions v10.1 and prior. This vulnerability is related to improper restrictions on XML External Entity (XXE) references when processing 3DXML files. The issue was discovered and reported by researcher rgod working with Trend Micro's Zero Day Initiative (ZDI, CISA).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). When opening a specially crafted 3DXML file, the application could disclose arbitrary files to remote attackers due to passing specially crafted content to the underlying XML parser without proper restrictions, such as prohibiting an external DTD. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (CISA).

Successful exploitation of this vulnerability could lead to the disclosure of arbitrary files to unauthorized actors. The vulnerability requires user interaction, as the target must visit a malicious page or open a malicious file for the exploit to be successful (ZDI).

The vulnerability requires local access and user interaction to be exploited. There are no known public exploits specifically targeting this vulnerability, and it is not exploitable remotely (CISA).

Datakit has released CrossCAD/Ware library Version 2021.2 as a fix for this vulnerability. Luxion has released an update to KeyShot (v10.2) that includes the fixed Datakit libraries. Users are recommended to update to the latest version. Additionally, users should avoid opening untrusted files from unknown sources (CISA).