CVE-2023-38085
📋 TL;DR
This vulnerability in Kofax Power PDF allows attackers to read memory beyond allocated bounds when parsing malicious JP2 files, potentially disclosing sensitive information. Users who open malicious PDF files or visit malicious web pages are affected. Attackers could combine this with other vulnerabilities to execute arbitrary code.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution in the context of the current user process, leading to full system compromise if combined with privilege escalation vulnerabilities.
Likely Case
Information disclosure through memory reads, potentially exposing sensitive data like passwords, keys, or other application memory contents.
If Mitigated
Limited impact with proper application sandboxing and memory protection controls in place.
🎯 Exploit Status
Requires user interaction to open malicious file. Information disclosure could be combined with other vulnerabilities for code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-924/
Restart Required: Yes
Instructions:
1. Check Kofax Power PDF version
2. Update to latest version from official Kofax website
3. Restart application and system if required
🔧 Temporary Workarounds
Disable JP2 file processing
windowsConfigure Power PDF to not process JP2 files or block JP2 file extensions
Application sandboxing
windowsRun Power PDF in restricted mode or sandboxed environment
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Power PDF execution
- Use email/web filtering to block JP2 files and educate users about suspicious attachments
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against patched versions in vendor advisoryCheck Version:
Open Power PDF → Help → About to check versionVerify Fix Applied:
Verify Power PDF version is updated to patched version and test with known safe JP2 files📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing JP2 files
- Unusual memory access patterns in application logs
Network Indicators:
- Downloads of JP2 files from untrusted sources
- Network traffic spikes during file processing
SIEM Query:
EventID for application crashes OR file extension contains '.jp2' AND process contains 'PowerPDF'