CVE-2020-27249
📋 TL;DR
This heap-based buffer overflow vulnerability in SoftMaker Office PlanMaker 2021 allows attackers to execute arbitrary code by tricking victims into opening specially crafted documents. The vulnerability affects users of PlanMaker 2021 revision 1014 who open malicious documents. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- SoftMaker Office PlanMaker 2021
📦 What is this software?
Planmaker 2021 by Softmaker
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Arbitrary code execution with user privileges, potentially leading to data exfiltration, credential theft, or lateral movement within the network.
If Mitigated
Limited impact with proper application sandboxing, limited user privileges, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploit requires user to open malicious document but no authentication needed. Public PoC available from Talos Intelligence.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Revision 1016 or later
Vendor Advisory: https://www.softmaker.com/en/security-advisory
Restart Required: No
Instructions:
1. Open SoftMaker Office. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Verify version is revision 1016 or higher.
🔧 Temporary Workarounds
Disable PlanMaker file associations
allPrevent .pmd/.pmdx files from automatically opening in PlanMaker
Windows: assoc .pmd=
Windows: assoc .pmdx=
Linux: update-mime-database
macOS: Get Info on file > Change Open With
Application sandboxing
allRun PlanMaker in restricted environment
Windows: AppLocker rules
Linux: Firejail firejail planmaker
macOS: Sandbox-exec
🧯 If You Can't Patch
- Block PlanMaker documents at email gateways and web proxies
- Implement least privilege: Run PlanMaker with standard user accounts, not administrator
🔍 How to Verify
Check if Vulnerable:
Open PlanMaker, go to Help > About, check if revision is 1014Check Version:
Windows: wmic product where name="SoftMaker Office PlanMaker 2021" get version
Linux: dpkg -l | grep softmaker
macOS: mdls -name kMDItemVersion /Applications/SoftMaker\ Office\ 2021/PlanMaker.appVerify Fix Applied:
Confirm revision is 1016 or higher in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Process crashes of planmaker.exe
- Unusual document file access patterns
- Suspicious child processes spawned from PlanMaker
Network Indicators:
- Unexpected outbound connections from PlanMaker process
- DNS requests for suspicious domains after document opening
SIEM Query:
process_name="planmaker.exe" AND (event_id=1000 OR child_process_creation!=null)