CVE-2023-37349
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious PDF files in Kofax Power PDF. The flaw exists in PDF parsing where improper data validation enables out-of-bounds writes. All users of affected Kofax Power PDF versions are vulnerable.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running Power PDF, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the victim's system when a user opens a malicious PDF.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only crashing the application.
🎯 Exploit Status
Exploitation requires user interaction but the vulnerability is in a commonly used file format. ZDI-CAN-20451 suggests active research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific patched versions
Vendor Advisory: https://docshield.kofax.com/PowerPDF/en_US/5.5.0-d3ps28gq9d/print/ReadMe.htm
Restart Required: Yes
Instructions:
1. Check current Power PDF version
2. Visit Kofax support portal
3. Download and install latest security update
4. Restart system
🔧 Temporary Workarounds
Disable PDF file association
windowsPrevent Power PDF from automatically opening PDF files
Control Panel > Default Programs > Set Associations > Change .pdf to another viewer
Application sandboxing
windowsRun Power PDF in restricted environment
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized PDF viewers
- Deploy email/web filtering to block malicious PDF attachments
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against Kofax security advisory. Versions before the patched release are vulnerable.Check Version:
In Power PDF: Help > About Power PDFVerify Fix Applied:
Verify Power PDF version matches or exceeds patched version listed in Kofax advisory.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs with memory access violations
- Unexpected child processes spawned from Power PDF
Network Indicators:
- Outbound connections from Power PDF process to unknown IPs
SIEM Query:
Process creation where parent process contains 'PowerPDF' AND (command line contains suspicious patterns OR destination IP not in allowed list)