CVE-2024-5301

Executive Summary

CVE-2024-5301 is a critical heap-based buffer overflow vulnerability in Kofax Power PDF, specifically during the parsing of PSD (Photoshop Document) files. The flaw allows remote code execution (RCE) in the context of the current user process. Exploitation requires user interaction—the victim must open a malicious PSD file or visit a crafted web page that triggers the parsing. The vulnerability has a CVSS score of 7.8 (High) and is classified under CWE-122 (Heap-based Buffer Overflow). No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a standalone desktop application (Kofax Power PDF) and does not involve package supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires user to open a file
• Attack Complexity: Low (AC:L) – no special conditions needed
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must open malicious file
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although no active exploitation has been observed, the vulnerability allows full system compromise under the user’s privileges. The lack of a patch increases risk for organizations using Kofax Power PDF.

Deep Dive & Mechanics

The vulnerability resides in the PSD file parsing module of Kofax Power PDF. PSD files contain image data with various layers, channels, and metadata. The parser fails to validate the length of user-supplied data before copying it into a fixed-length heap-based buffer. This leads to a heap-based buffer overflow, which can be leveraged to overwrite adjacent heap memory structures.

Technical Details:

• Root Cause: Improper bounds checking when processing a specific PSD chunk (likely related to layer data or image resource blocks).
• Trigger: A specially crafted PSD file with an oversized field (e.g., a layer name or channel data) causes the parser to copy more data than the allocated buffer.
• Impact: Overwriting heap metadata or function pointers can lead to arbitrary code execution. The attacker gains control of the instruction pointer (EIP/RIP) and can execute shellcode in the context of the Kofax Power PDF process.
• User Interaction: The victim must open the malicious PSD file via the application (e.g., File > Open) or via a web browser that triggers the application to parse the file.

Attack Scenario:

1. Attacker crafts a malicious PSD file with an oversized field.
2. Attacker delivers the file via email, download link, or social engineering.
3. Victim opens the file with Kofax Power PDF.
4. The parser overflows the heap buffer, allowing the attacker to execute arbitrary code.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the CWE-122 description, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void parse_psd_layer(char *layer_data, size_t layer_size) {
    char buffer[256]; // fixed-length heap buffer
    // No length check
    memcpy(buffer, layer_data, layer_size); // overflow if layer_size > 256
}

A patched version would include bounds checking:

// Patched pseudo-code
void parse_psd_layer(char *layer_data, size_t layer_size) {
    char buffer[256];
    if (layer_size > sizeof(buffer)) {
        // Handle error or truncate
        return;
    }
    memcpy(buffer, layer_data, layer_size);
}

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a typical heap-based buffer overflow exploitation would involve:

1. Crafting the PSD File: Use a hex editor or a scripting language (e.g., Python) to modify a valid PSD file. Identify the vulnerable field (e.g., layer name length) and set it to a large value (e.g., 0x1000 bytes).
2. Heap Spraying: To increase reliability, spray the heap with NOP sleds and shellcode before triggering the overflow.
3. Overwrite Heap Metadata: Overwrite a function pointer (e.g., a vtable pointer) to redirect execution to the shellcode.
4. Shellcode: Use a standard Windows shellcode (e.g., msfvenom -p windows/exec CMD=calc.exe) to demonstrate code execution.

Example Python script to generate a malicious PSD (conceptual):

# This is a conceptual example; actual PSD structure is complex.
import struct

def create_malicious_psd():
    # Minimal PSD header
    header = b'8BPS' + struct.pack('>H', 1) + b'\x00' * 6 + struct.pack('>I', 100) + struct.pack('>I', 100)
    # Overflow payload
    overflow = b'A' * 0x1000  # large buffer
    # Combine
    psd_data = header + overflow
    with open('malicious.psd', 'wb') as f:
        f.write(psd_data)

create_malicious_psd()

Usage: Deliver the malicious.psd file to the victim and convince them to open it with Kofax Power PDF.

Blue Team (Defense)

• Detection: Monitor for unusual PSD file sizes or anomalous process behavior (e.g., Kofax Power PDF crashing or spawning child processes).
• Prevention: Use application whitelisting to block unknown PSD files. Disable automatic file parsing in web browsers.
• Mitigation: If possible, use a sandbox or virtualized environment to open untrusted PSD files. Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; generate upon discovery)
• Network Indicators: Outbound connections from Kofax Power PDF process to unknown IPs (if shellcode includes reverse shell).
• Process Anomalies: Kofax Power PDF process (e.g., PowerPDF.exe) crashing or exhibiting high memory usage.
• Registry Changes: Unauthorized modifications to HKEY_CURRENT_USER\Software\Kofax\PowerPDF (if persistence is attempted).
• File System: Creation of suspicious files in %TEMP% or %APPDATA% by the exploited process.

Detection Engineering

YARA Rule

rule CVE_2024_5301_Kofax_PSD_Overflow {
    meta:
        description = "Detects malicious PSD files exploiting CVE-2024-5301"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5301"
    strings:
        $psd_header = "8BPS"
        $large_field = { 00 00 10 00 } // Example: large size field (adjust based on actual exploit)
    condition:
        $psd_header at 0 and $large_field
}

Sigma Rule

title: CVE-2024-5301 Kofax Power PDF PSD Parsing Overflow
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-5301 via process crash or anomalous behavior
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\PowerPDF.exe'
        CommandLine|contains: '.psd'
    condition: selection
falsepositives:
    - Legitimate PSD file opening
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5301 Kofax Power PDF PSD Exploit Outbound"; flow:to_server,established; content:"|8BPS|"; depth:4; content:"|00 00 10 00|"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  • Disable automatic file parsing for PSD files in Kofax Power PDF settings.
  • Educate users not to open PSD files from untrusted sources.
  • Use endpoint detection and response (EDR) solutions to monitor for exploitation attempts.
• Long-term Fix:
  • Await an official patch from Kofax. Monitor the vendor’s security advisory page.
  • Consider using alternative PDF software that is actively maintained.
• Workarounds:
  • Convert PSD files to a safer format (e.g., PNG) before opening in Kofax Power PDF.
  • Run Kofax Power PDF in a sandboxed environment (e.g., Windows Sandbox, Firejail).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert