CVE-2024-27344
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious PDF files in Kofax Power PDF. The flaw exists in PDF file parsing where improper data validation leads to memory corruption. All users of affected Kofax Power PDF versions are vulnerable.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or system compromise on the user's workstation, potentially leading to credential theft, data exfiltration, or installation of persistent malware.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially resulting in application crash but no code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability is in PDF parsing logic, making reliable exploitation possible but requiring crafted PDF files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific patched version
Vendor Advisory: https://docshield.kofax.com/PowerPDF/en_US/5.5.0-d3s176i9m5/print/online/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ReleaseNotes.06.3.html
Restart Required: Yes
Instructions:
1. Open Kofax Power PDF
2. Navigate to Help > Check for Updates
3. Follow prompts to download and install latest version
4. Restart application and system if prompted
🔧 Temporary Workarounds
Disable PDF file association
windowsPrevent Kofax Power PDF from automatically opening PDF files
Control Panel > Default Programs > Set Associations > Find .pdf > Change to different PDF reader
Application control policy
windowsRestrict execution of Kofax Power PDF using application whitelisting
🧯 If You Can't Patch
- Implement network segmentation to isolate systems running vulnerable software
- Deploy endpoint detection and response (EDR) with memory protection capabilities
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Kofax Power PDF and compare version against vendor advisoryCheck Version:
In Kofax Power PDF: Help > AboutVerify Fix Applied:
Verify installed version matches or exceeds patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes of Kofax Power PDF
- Unusual process creation from PDF reader
- Memory access violations in application logs
Network Indicators:
- Downloads of PDF files from untrusted sources
- Outbound connections initiated after PDF file opening
SIEM Query:
Process Creation where ParentImage contains 'PowerPDF' and CommandLine contains '.pdf'