PT-2017-17739 · Nitro · Nitro Pro

Mr_Me · Published 2017-08-03 · Updated 2020-08-04 · CVE-2017-7442

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro Pro version 11.0.3.173

Description The issue allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.

Recommendations For Nitro Pro version 11.0.3.173, consider disabling the saveAs and launchURL functions until a patch is available to prevent potential exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-7442

Affected Products

Nitro Pro

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb · Exploit
• 🔥 https://exploit-db.com/exploits/42418 · Exploit
• 🔥 http://srcincite.io/advisories/src-2017-0005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7442 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7442 · Vendor Advisory