CVE-2024-5512

Executive Summary

CVE-2024-5512 is an out-of-bounds read vulnerability in Kofax Power PDF’s JP2 file parsing engine. The flaw allows a remote attacker to leak sensitive memory contents when a user opens a malicious JP2 file or visits a crafted web page. With a CVSS score of 3.3 (Low), the direct impact is limited to information disclosure, but the ZDI report notes it can be chained with other vulnerabilities to achieve arbitrary code execution. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Local (requires user interaction)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low score reflects the need for user interaction and the limited direct impact. However, the potential for chaining with other vulnerabilities elevates the risk in targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the JP2 (JPEG 2000) file parser of Kofax Power PDF. When parsing a specially crafted JP2 file, the software fails to validate the length of user-supplied data before reading from a buffer. This results in a read past the end of an allocated object, leaking heap memory contents.

Root Cause:

• Lack of bounds checking on a buffer read operation during JP2 image processing.
• The parser trusts the file’s internal size fields without verifying they do not exceed the allocated buffer.

Attack Vector:

• An attacker crafts a malicious JP2 file containing an oversized or malformed data segment.
• The victim opens the file in Kofax Power PDF (or visits a page that triggers the parser).
• The parser reads beyond the buffer, copying sensitive memory (e.g., encryption keys, passwords, other document data) into the output.

Chaining Potential:

• The leaked memory can be used to bypass ASLR or leak secrets.
• Combined with a separate write primitive (e.g., heap overflow), an attacker could achieve code execution.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the JP2 parsing module (likely JP2Parser.dll or similar). A hypothetical fix would add a bounds check before the read operation:

Vulnerable (pseudocode):

void parse_jp2_data(char *buffer, uint32_t size) {
    uint32_t data_length = *(uint32_t*)(buffer + 8); // read from file
    // No check: data_length may be larger than size
    memcpy(output, buffer + 12, data_length); // out-of-bounds read
}

Patched (pseudocode):

void parse_jp2_data(char *buffer, uint32_t size) {
    uint32_t data_length = *(uint32_t*)(buffer + 8);
    if (data_length > size - 12) {
        // error handling
        return;
    }
    memcpy(output, buffer + 12, data_length);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Kofax Power PDF (any version) installed on a Windows target.
• Ability to deliver a malicious JP2 file (e.g., via email, download, or web page).

Steps:

1. Craft a JP2 file with a manipulated data_length field (e.g., set to 0xFFFFFFFF).
2. Embed the file in a phishing email or host it on a website.
3. When the victim opens the file, the parser reads beyond the buffer.
4. Capture the leaked data from the application’s output (e.g., error messages, rendered image artifacts, or memory dumps).

Lab Setup:

• Use a Windows VM with Kofax Power PDF installed.
• Generate a malformed JP2 using a hex editor (e.g., 010 Editor).
• Monitor with a debugger (x64dbg) to observe the out-of-bounds read.

Blue Team

Detection:

• Monitor for unusual JP2 file sizes or malformed headers.
• Use the YARA and Sigma rules below to detect malicious JP2 files.
• Enable application whitelisting to block untrusted PDF tools.

Hunting:

• Search for processes (e.g., PowerPDF.exe) reading large amounts of memory unexpectedly.
• Look for crashes in the JP2 parser module.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples yet; placeholder)
  • SHA256: <unknown>
• File Patterns:
  • JP2 files with data_length field > 0x100000 (1 MB)
  • JP2 files with invalid box sizes (e.g., 0x00000000 or 0xFFFFFFFF)
• Network:
  • Outbound connections from PowerPDF.exe to unknown IPs (if chained with RCE)
• Registry:
  • Unusual entries under HKLM\SOFTWARE\Kofax\PowerPDF (if persistence attempted)

Detection Engineering

YARA Rule

rule CVE_2024_5512_JP2_OOB_Read {
    meta:
        description = "Detects malformed JP2 files exploiting CVE-2024-5512"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://www.zerodayinitiative.com/advisories/ZDI-CAN-22021"
    strings:
        $jp2_magic = { 00 00 00 0C 6A 50 20 20 } // JP2 signature
        $large_size = { FF FF FF FF } // suspicious data_length
    condition:
        $jp2_magic at 0 and $large_size
}

Sigma Rule

title: CVE-2024-5512 JP2 Out-of-Bounds Read
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-5512 via malformed JP2 files
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\PowerPDF.exe'
        TargetFilename|endswith: '.jp2'
    condition: selection
falsepositives:
    - Legitimate large JP2 files (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5512 JP2 Out-of-Bounds Read Attempt"; flow:to_server,established; file_data; content:"|00 00 00 0C 6A 50 20 20|"; offset:0; depth:8; content:"|FF FF FF FF|"; within:12; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Disable JP2 file parsing in Kofax Power PDF if possible (via settings or registry).
• Use a different PDF viewer (e.g., Adobe Acrobat, Foxit) until a patch is released.
• Block JP2 files at email gateways and web proxies.

Long-Term:

• Monitor vendor for patches (Kofax has not responded).
• Apply the principle of least privilege to the PDF application.
• Enable Windows Defender Exploit Guard (e.g., Control Flow Guard, ASLR).

Workaround:

• Convert JP2 files to PNG or JPEG before opening in Kofax Power PDF.

Valters IT
DevSecOps & Cyber Threat Intelligence