CVE-2023-51565
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious XPS files in Kofax Power PDF. The flaw is a use-after-free issue in XPS file parsing that enables code execution in the current process context. All users of affected Kofax Power PDF versions are at risk.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the PDF application user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration through spear-phishing campaigns targeting users who open malicious XPS attachments.
If Mitigated
Limited impact if application runs with minimal privileges, sandboxed, or network segmentation prevents lateral movement.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious XPS file is opened. ZDI-CAN-21975 suggests active research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific patched version
Vendor Advisory: https://docshield.kofax.com/powerpdf/en_US/5.0.0-d3s1tnvxaq/print/online/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ReleaseNotes.07.03.html
Restart Required: Yes
Instructions:
1. Check current Power PDF version. 2. Visit Kofax support portal. 3. Download and install latest security update. 4. Restart system to ensure patch is fully applied.
🔧 Temporary Workarounds
Disable XPS file association
windowsRemove Power PDF as default handler for XPS files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .xps > Change to different program
Block XPS files at perimeter
allPrevent XPS files from entering network via email or web gateways
🧯 If You Can't Patch
- Run Power PDF with restricted user privileges to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables from running post-exploitation
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against vendor advisory; if using affected version and XPS files can be opened, system is vulnerable.Check Version:
Open Power PDF > Help > About Power PDFVerify Fix Applied:
Verify Power PDF version is updated to patched version listed in vendor advisory and test with known safe XPS file.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs with memory access violations
- Unexpected child processes spawned from Power PDF
Network Indicators:
- Outbound connections from Power PDF process to unknown IPs
- DNS requests for command-and-control domains
SIEM Query:
Process Creation where ParentImage contains 'PowerPDF' and CommandLine contains unusual parameters