CVE-2020-28587
📋 TL;DR
This heap-based buffer overflow vulnerability in SoftMaker Office PlanMaker 2021 allows attackers to execute arbitrary code by tricking victims into opening a malicious document. The vulnerability affects users of PlanMaker 2021 revision 1014 who open untrusted documents. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- SoftMaker Software GmbH SoftMaker Office PlanMaker 2021
📦 What is this software?
Planmaker 2021 by Softmaker
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete host takeover, data exfiltration, and lateral movement within the network.
Likely Case
Arbitrary code execution with the victim's user privileges, potentially leading to malware installation, credential theft, and data compromise.
If Mitigated
Application crash (denial of service) if exploit fails or security controls prevent code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening a document) but the technical complexity is low once a malicious document is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Revision 1016 or later
Vendor Advisory: https://www.softmaker.com/en/security-advisory
Restart Required: Yes
Instructions:
1. Open SoftMaker Office
2. Go to Help > Check for Updates
3. Install available updates
4. Restart PlanMaker application
🔧 Temporary Workarounds
Disable document parsing
allPrevent PlanMaker from opening untrusted document formats
Application sandboxing
allRun PlanMaker in a sandboxed environment to limit exploit impact
🧯 If You Can't Patch
- Implement application whitelisting to block PlanMaker execution
- Deploy endpoint detection and response (EDR) to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check PlanMaker version in Help > About PlanMaker. If revision is 1014, system is vulnerable.Check Version:
On Windows: Check Help > About PlanMaker. On Linux/macOS: Check application info or package manager.Verify Fix Applied:
Verify version shows revision 1016 or higher in Help > About PlanMaker.📡 Detection & Monitoring
Log Indicators:
- Application crashes of PlanMaker.exe
- Unusual process creation from PlanMaker
- Memory access violations in application logs
Network Indicators:
- Unexpected outbound connections from PlanMaker process
- Document downloads from untrusted sources
SIEM Query:
Process:PlanMaker.exe AND (EventID:1000 OR ParentProcess:PlanMaker.exe)