CVE-2024-27337
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious TIF files in Kofax Power PDF. Attackers can exploit a stack-based buffer overflow during TIF file parsing to gain control of the application process. All users running vulnerable versions of Kofax Power PDF are affected.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the PDF application user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation on the victim's machine, with attackers using social engineering to deliver malicious TIF files via email or downloads.
If Mitigated
Application crash or denial of service if exploit fails, with potential data loss from corrupted PDF files.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once malicious TIF file is crafted. ZDI-CAN-22033 suggests coordinated disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific version
Vendor Advisory: https://docshield.kofax.com/PowerPDF/en_US/5.5.0-d3ps5jgkvi/print/ReadMe.htm
Restart Required: Yes
Instructions:
1. Check current Power PDF version
2. Visit Kofax support portal
3. Download and install latest update
4. Restart system
🔧 Temporary Workarounds
Disable TIF file association
windowsPrevent Power PDF from automatically opening TIF files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .tif/.tiff to open with different application
Application control blocking
windowsUse AppLocker or Windows Defender Application Control to block Power PDF execution of untrusted TIF files
🧯 If You Can't Patch
- Implement network segmentation to isolate PDF processing workstations
- Use email filtering to block TIF attachments and web filtering to block TIF downloads
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against Kofax security advisory. If version is older than patched release, system is vulnerable.Check Version:
In Power PDF: Help > About Power PDFVerify Fix Applied:
Verify Power PDF version matches or exceeds patched version listed in Kofax advisory.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs with memory access violations
- Windows Application logs showing Power PDF exceptions
- Antivirus alerts for malicious TIF files
Network Indicators:
- Unusual outbound connections from Power PDF process
- Downloads of TIF files from suspicious sources
SIEM Query:
source="*Power PDF*" AND (event_id=1000 OR event_id=1001) OR process_name="PowerPDF.exe" AND parent_process="explorer.exe"