PT-2023-31066 · Pdf24 · Pdf24 Creator

Lukas Donaubauer + 1 · Published 2023-12-19 · Updated 2024-01-20 · CVE-2023-49147

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PDF24 Creator version 11.14.0

Description An issue was discovered in the configuration of the msi installer file of PDF24 Creator, which produces a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions, such as an oplock on faxPrnInst.log, to open a SYSTEM cmd.exe. The issue can be exploited for Windows privilege escalation via an oplock on a privileged read.

Recommendations For PDF24 Creator version 11.14.0, as a temporary workaround, consider restricting access to the repair function of msiexec.exe to minimize the risk of exploitation. Additionally, avoid using the oplock on faxPrnInst.log until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-49147

Affected Products

Pdf24 Creator

References · 9

• 🔥 http://seclists.org/fulldisclosure/2023/Dec/18 · Exploit
• 🔥 https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh · Exploit
• 🔥 http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49147 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49147 · Vendor Advisory
• https://t.me/cvenotify/65951 · Telegram Post
• https://twitter.com/CVEnew/status/1737249696039465429 · Twitter Post
• https://t.me/cvenotify/64291 · Telegram Post
• https://twitter.com/alex4breakme/status/1748776273051037806 · Twitter Post