PT-2021-22948 · Adobe · Acrobat Reader For Android

Published 2021-10-15 · Updated 2023-10-19 · CVE-2021-40724

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acrobat Reader for Android versions 21.8.0 and earlier

Description The issue is a Path traversal vulnerability that allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a victim must open a malicious file. The vulnerability can be leveraged through a series of steps, including loading a website with an exploit, triggering an exported component from the Acrobat Reader app, downloading a payload native library, and exploiting the DIR traversal vulnerability.

Recommendations For Acrobat Reader for Android versions 21.8.0 and earlier, update to a version later than 21.8.0 to resolve the issue. As a temporary workaround, consider avoiding opening files from untrusted sources until a patch is available. Restrict access to the app's internal storage to minimize the risk of exploitation. Avoid using the app to open potentially malicious files until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-40724

Affected Products

Acrobat Reader For Android

References · 8

• https://osv.dev/vulnerability/CVE-2021-40724 · Vendor Advisory
• https://helpx.adobe.com/security/products/reader-mobile/apsb21-89.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40724 · Security Note
• https://t.me/cibsecurity/30644 · Telegram Post
• https://twitter.com/androidmalware2/status/1715248621308821548 · Twitter Post
• https://t.me/ckure/10554 · Telegram Post
• https://t.me/cybersecuritytechnologies/5215 · Telegram Post
• https://t.me/pentestingnews/17246 · Telegram Post