CVE-2024-5304
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious TGA files in Kofax Power PDF. The flaw exists in how the software handles TGA file data, enabling buffer overflow attacks. All users of affected Kofax Power PDF versions are at risk.
💻 Affected Systems
- Kofax Power PDF
📦 What is this software?
Power Pdf by Tungstenautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to data exfiltration, malware installation, or persistence mechanisms being established on the compromised system.
If Mitigated
Application crash or denial of service if exploit fails, but no code execution due to security controls like DEP or ASLR.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. Technical details suggest reliable exploitation is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kofax security advisory for specific patched version
Vendor Advisory: https://www.kofax.com/security/advisories
Restart Required: Yes
Instructions:
1. Check current Power PDF version
2. Visit Kofax security advisory page
3. Download and install latest security update
4. Restart system if prompted
🔧 Temporary Workarounds
Disable TGA file association
windowsRemove Power PDF as default handler for .tga files to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .tga association to another program
Block TGA files at perimeter
allPrevent TGA files from entering the network via email or web downloads
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized Power PDF execution
- Use endpoint protection with memory protection features enabled
🔍 How to Verify
Check if Vulnerable:
Check Power PDF version against Kofax security advisory. Versions before the patched release are vulnerable.Check Version:
In Power PDF: Help > About Power PDFVerify Fix Applied:
Confirm Power PDF version matches or exceeds patched version listed in Kofax advisory.📡 Detection & Monitoring
Log Indicators:
- Power PDF crash logs with memory access violations
- Unexpected Power PDF processes spawning child processes
Network Indicators:
- Downloads of TGA files from untrusted sources
- Outbound connections from Power PDF process to unknown IPs
SIEM Query:
Process creation where parent process contains 'powerpdf' and child process is cmd.exe, powershell.exe, or other suspicious binaries