Nitro PDF Remote Code Execution Vulnerability

vendor:

Nitro PDF

by:

Francis Provencher

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Nitro PDF

Affected Version From: Nitro Pro 10.5.7.32 and lower

Affected Version To: Nitro Reader 5.5.3.1 and lower

Patch Exists: YES

Related CWE: N/A

CPE: a:gonitro:nitro_pdf

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2015

Nitro PDF Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Nitro PDF 10 (10.5.7.32). User interaction is required to exploit this vulnerability in that the target must open a malicious file. A specially crafted PDF with a specific FunctionType 0 and an invalid /Domain key can cause a stack-based buffer overflow, resulting in arbitrary code execution.

Mitigation:

GoNitro fixed this issue in 2016-01-21.

Source

Exploit-DB raw data:

#####################################################################################

Application: Nitro PDF

Platforms: Windows

Versions: Nitro Pro 10.5.7.32 and lower  & Nitro Reader 5.5.3.1 and lower

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_ @protekresearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Nitro develops commercial software used to create, edit, sign, and secure Portable Document Format (PDF) files and digital documents. The Nitro ecosystem consists of Nitro Pro, Nitro Cloud, Nitro Reader, and a suite of document conversion sites.

Nitro’s product family is intended for the professional market and although its desktop products are Windows-only, Nitro Cloud is compatible with any web browser on any machine. The Nitro PDF Reader is freeware for both personal and professional use.

(https://en.wikipedia.org/wiki/Nitro_PDF)

#####################################################################################

============================
2) Report Timeline
============================

2015-12-29: Francis Provencher from COSIG report issue to GoNitro sales team;
2016-01-02: GoNitro confirmed this issue;
2016-01-21: GoNitro fixed this issue;

https://www.gonitro.com/support/security-update
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Nitro PDF 10 (10.5.7.32).
User interaction is required to exploit this vulnerability in that the target must open a malicious file.

A specially crafted PDF with a specific FunctionType 0 and an invalid /Domain can force an heap memory corruption

by pointing to an uninitialized space of memory.An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.1

.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-13.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39546.zip

###############################################################################