CVE-2024-5303

Executive Summary

CVE-2024-5303 is a critical out-of-bounds write vulnerability in Kofax Power PDF during the parsing of PSD (Photoshop Document) files. The flaw resides in the lack of proper validation of user-supplied data, allowing an attacker to write past the end of an allocated buffer. Successful exploitation requires user interaction (opening a malicious PSD file or visiting a malicious page) and leads to remote code execution in the context of the current process. With a CVSS score of 7.8, this vulnerability poses a significant risk to enterprise environments using Kofax Power PDF for document processing. No public exploit code or patch is currently available, making detection and mitigation critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary desktop application (Kofax Power PDF) and is distributed via vendor channels. No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Exploitation can lead to full system compromise, but requires user interaction. No public exploit exists, but the vulnerability is weaponizable.

Deep Dive & Mechanics

The vulnerability is a classic out-of-bounds write (CWE-787) in the PSD file parser of Kofax Power PDF. PSD files contain layered image data with complex headers and compression schemes. The parser fails to validate the size of user-supplied data before writing to a heap buffer, allowing an attacker to craft a PSD file with a malicious header or layer record that triggers a write past the allocated buffer.

Root Cause: The parser reads a length field from the PSD file (e.g., layer record size, channel data length) and uses it directly in a memory copy operation without verifying that the source data fits within the allocated destination buffer. This results in a heap-based buffer overflow.

Attack Vector: An attacker delivers a specially crafted PSD file via email, web download, or other means. When the victim opens the file in Kofax Power PDF, the parser processes the malformed data, overwriting adjacent heap memory. The attacker can control the overwritten data to hijack execution flow (e.g., overwrite a function pointer or vtable entry) and execute arbitrary code.

Impact: Full remote code execution in the context of the current user. The attacker can install malware, exfiltrate data, or pivot to other systems.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding bounds checking before memory copy operations. Below is a simplified example of vulnerable vs. patched pseudocode.

Vulnerable Code (C-style):

void parse_psd_layer(unsigned char *data, size_t data_size) {
    unsigned char *buffer = malloc(1024);
    uint32_t layer_size = *(uint32_t*)(data + 10); // read from file
    memcpy(buffer, data + 14, layer_size); // no bounds check
}

Patched Code:

void parse_psd_layer(unsigned char *data, size_t data_size) {
    unsigned char *buffer = malloc(1024);
    uint32_t layer_size = *(uint32_t*)(data + 10);
    if (layer_size > 1024) {
        // error handling
        return;
    }
    memcpy(buffer, data + 14, layer_size);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Kofax Power PDF (any version before patch)
• A crafted PSD file with a malicious layer record

Steps:

1. Create a PSD file with a manipulated layer size field (e.g., set layer_size to 0xFFFFFFFF).
2. Embed shellcode in the PSD data that will be copied past the buffer.
3. Deliver the file to the target via phishing email or web download.
4. When the target opens the file, the overflow overwrites a function pointer (e.g., a vtable entry in the parser).
5. Redirect execution to the shellcode.

Example PSD Structure (simplified):

[PSD Header] [Color Mode Data] [Image Resources] [Layer and Mask Information]

The malicious layer record contains an oversized layer_size field.

No public exploit code is available. The above is a conceptual approach.

Blue Team (Defensive)

Detection:

• Monitor for unusual PSD file sizes or malformed headers.
• Use YARA rules to scan for known malicious patterns in PSD files.
• Enable ASLR and DEP on all endpoints.
• Restrict execution of Kofax Power PDF in sandboxed environments.

Hunting:

• Search for processes (e.g., PowerPDF.exe) crashing with heap corruption errors.
• Look for suspicious child processes spawned by PowerPDF (e.g., cmd.exe, powershell.exe).
• Analyze network connections from the host after file opening.

Indicators of Compromise (IOCs)

• File Hashes: No known samples yet.
• Process Names: PowerPDF.exe, Kofax.PowerPDF.exe
• Network Indicators: Outbound connections to unknown IPs after exploitation.
• Registry Keys: HKLM\Software\Kofax\PowerPDF (may be modified)
• File Artifacts: Temporary files in %TEMP% with .psd extension or unusual names.

Detection Engineering

YARA Rule

rule CVE_2024_5303_PSD_Overflow {
    meta:
        description = "Detects malicious PSD files targeting CVE-2024-5303"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-5303"
    strings:
        $psd_header = { 38 42 50 53 } // "8BPS" in hex
        $large_layer_size = { FF FF FF FF } // suspicious size
    condition:
        $psd_header at 0 and $large_layer_size
}

Sigma Rule

title: CVE-2024-5303 Kofax Power PDF PSD Overflow
id: 8a3f2c1e-5b7d-4f9a-8c2e-1d3f5a7b9c0d
status: experimental
description: Detects potential exploitation of CVE-2024-5303 via PSD file opening
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\PowerPDF.exe'
        CommandLine|contains: '.psd'
    condition: selection
falsepositives:
    - Legitimate PSD file opening
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5303 Kofax Power PDF PSD Overflow"; flow:to_server,established; content:"|38 42 50 53|"; offset:0; depth:4; content:"|FF FF FF FF|"; within:1024; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PSD file parsing in Kofax Power PDF if possible (e.g., via group policy or application settings).
2. Block PSD files at email gateways and web proxies.
3. Apply vendor patch when available (monitor Kofax security advisories).
4. Use application whitelisting to prevent unauthorized executables.

Long-term:

• Migrate to alternative PDF software with better security posture.
• Implement endpoint detection and response (EDR) with behavioral analytics.
• Conduct regular security awareness training to prevent phishing attacks.

Workaround: Convert PSD files to safe formats (e.g., PNG, JPEG) before opening in Kofax Power PDF.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert