The Beyond Security’s SecuriTeam has disclosed multiple vulnerabilities in Nitro Pro PDF reported to them by two security researchers.
Nitro Pro is the PDF reader and editor that does everything you will ever need to do with PDF files. The powerful but snappy editor lets you change PDF documents with ease, and comes with a built-in OCR engine that can transform scanned documents into editable files. Fill up forms, annotate and sign them as part of your workflow, and easily merge multiple documents or delete selected pages as necessary.
The vulnerabilities found in Nitro PDF are:
- Doc.saveAs Directory Traversal Arbitrary File Write that lead to Command Execution
- App.launchURL Command Execution
- JPEG2000 npdf.dll Use-After-Free
- Forms Parsing NPForms.npp Use-After-Free
- File Parsing Count Field npdf.dll Memory Corruption
- NewWindow Launch Action NPActions.npp Command
- URI Action NPActions.npp Command Execution
Doc.saveAs Directory Traversal Arbitrary File Write that lead to Command Execution
The Doc.saveAs function does not validate either the file extension, the content of the PDF or if the path contains traversals before saving it to disk.
An attacker can leverage this to write a malicious file to the operating system in any path. This alone can be used to achieve remote code execution by writing into the users startup folder.
App.launchURL Command Execution
The App.launchURL function allows an attacker to execute commands with the privileges of the currently running user. However, a security alert or warning is typically triggered when doing so.
This can be bypassed if a $ sign is used within the path. Note that if an attacker does this, they will execute the file from the current directory, which may not be ideal for exploitation.
JPEG2000 npdf.dll Use-After-Free
When parsing a malformed embedded JPEG2000 image into a PDF the process will destroy an object in memory, forcing a pointer to be reused after it has been free. The reuse functions are located in the npdf.dll.
A detailed explanation can also be found here for another vulnerabilty.
The vendor has released patches to address this vulnerability. The new version 11.0.5 has patched all the security vulnerabilities.