CVE-2023-37331
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious GIF files in Kofax Power PDF. Attackers can gain control of the affected system through a stack-based buffer overflow. All users of vulnerable Kofax Power PDF versions are affected.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malicious actor executes code with user privileges, potentially installing malware, stealing documents, or establishing persistence on the system.
If Mitigated
Attack fails due to proper controls, potentially causing application crash but no code execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once a malicious GIF is crafted. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-926/
Restart Required: Yes
Instructions:
1. Check Kofax website for security updates
2. Download latest version of Power PDF
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable GIF file association
windowsPrevent Power PDF from automatically opening GIF files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .gif association to another application
Block GIF files at perimeter
allPrevent malicious GIF files from reaching users
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Use email filtering to block GIF attachments from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against vendor's patched version listCheck Version:
Open Power PDF > Help > AboutVerify Fix Applied:
Verify Power PDF version is updated to latest release📡 Detection & Monitoring
Log Indicators:
- Power PDF crashes when processing GIF files
- Unexpected child processes spawned from Power PDF
Network Indicators:
- Downloads of GIF files followed by unusual outbound connections
SIEM Query:
Process Creation where Parent Process contains 'PowerPDF' AND Command Line contains unusual parameters