CVE-2023-37337
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious JP2 image files in Kofax Power PDF. Attackers can exploit improper bounds checking during JP2 file parsing to write beyond allocated memory boundaries and gain code execution. All users of affected Kofax Power PDF versions are vulnerable.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the PDF viewer process, potentially leading to lateral movement, data exfiltration, or ransomware deployment.
Likely Case
Local privilege escalation leading to user account compromise, data theft, or malware installation on the affected system.
If Mitigated
Application crash (denial of service) if memory corruption occurs but code execution fails.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability is in JP2 file parsing specifically.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references - check Kofax advisory for exact version
Vendor Advisory: https://docshield.kofax.com/PowerPDF/en_US/4.0.0-4.0.1/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ReleaseNotes.04.01.html
Restart Required: Yes
Instructions:
1. Check current Power PDF version
2. Download latest version from Kofax website
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable JP2 file association
windowsRemove JP2 file type association with Kofax Power PDF to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .jp2 association with Power PDF
Block JP2 files at perimeter
allConfigure email/web gateways to block JP2 file attachments
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized PDF viewers
- Use sandboxed environments for opening untrusted PDF files
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against Kofax security advisory. Versions prior to the patched release are vulnerable.Check Version:
Open Power PDF > Help > About Power PDFVerify Fix Applied:
Verify Power PDF version matches or exceeds the patched version specified in Kofax advisory.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs with memory access violations
- Unexpected process creation from PDF viewer
Network Indicators:
- Downloads of JP2 files from untrusted sources
- Outbound connections from PDF viewer process
SIEM Query:
Process Creation where Parent Process contains 'PowerPDF' AND Command Line contains '.jp2'