CVE-2023-44435
📋 TL;DR
This is a use-after-free vulnerability in Kofax Power PDF's file parsing that allows remote attackers to execute arbitrary code when a user opens a malicious PDF file. Attackers can exploit this to run code with the same privileges as the PDF viewer process. All users of affected Kofax Power PDF versions are vulnerable.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious code execution in user context leading to credential theft, lateral movement, or data exfiltration.
If Mitigated
Limited impact with proper application sandboxing, but potential for user data compromise remains.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious PDF) but the vulnerability itself is unauthenticated. File parsing vulnerabilities are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific patched version
Vendor Advisory: https://docshield.kofax.com/PowerPDF/en_US/5.0.0-5.0.0.10/wwhelp/wwhimpl/js/html/wwhelp.htm#href=Security.07.3.html
Restart Required: Yes
Instructions:
1. Check current Power PDF version. 2. Download latest version from Kofax website or use built-in update feature. 3. Install update. 4. Restart system to ensure complete patch application.
🔧 Temporary Workarounds
Disable PDF file association
windowsPrevent Power PDF from automatically opening PDF files
Control Panel > Default Programs > Set Associations > Change .pdf to different viewer
Application sandboxing
windowsRun Power PDF in restricted environment
🧯 If You Can't Patch
- Block PDF files from untrusted sources at email/web gateways
- Use alternative PDF viewers that are not vulnerable
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against Kofax security advisory. Vulnerable if using unpatched version.Check Version:
Open Power PDF > Help > About Power PDFVerify Fix Applied:
Verify Power PDF version matches or exceeds patched version listed in Kofax advisory.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs
- Unexpected process creation from PDF viewer
- Suspicious file access patterns
Network Indicators:
- Outbound connections from PDF viewer process to suspicious IPs
- DNS requests for command and control domains
SIEM Query:
Process Creation where ParentImage contains 'PowerPDF' and CommandLine contains suspicious patterns