Local Privilege Escalation via MSI Installer in Nitro PDF Pro

Vendor description

"We are on a mission to deliver a one-of-a-kind platform that accelerates document productivity for businesses around the world.

Nitro was born in a bustling Melbourne laneway back in 2005. It started with a team of three, a single product and a goal to provide the world with better tools for everyday work. Our team now spans the globe and works with over half of the Fortune 500, but we haven't strayed too far from our roots. We put our customers, employees, and communities at the center of everything we do."

Source: https://www.gonitro.com/about/our-story   

Business recommendation

The vendor provides a patch which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.

Vulnerability overview/description

1) Local Privilege Escalation via MSI Installer (CVE-2024-35288)

The Nitro PDF Pro application uses a .msi installer file (embedded into an executable .exe installer file) for installation. The MSI installer uses custom actions in repair mode in an unsafe way. Attackers with low-privileged system access to a Windows system where Nitro PDF Pro is installed, can exploit the cached MSI installer's custom actions to effectively escalate privileges and get a command prompt running in context of NT AUTHORITY\SYSTEM.

Note:
This attack does not work using a recent version of the Edge Browser or Internet Explorer. A different browser, such as Chrome or Firefox, needs to be used. Also make sure, that Edge or IE have not been set as default browser and that Firefox or Chrome are not running before attempting to exploit it. Otherwise, the spawned process would be running with your own permissions and the installer will just add a new tab to the browser, instead of spawning a new process with SYSTEM.

Proof of concept

1) Local Privilege Escalation via MSI Installer (CVE-2024-35288)

After the installation of the software in standard configuration, any low-privileged user can access the cached (randomly named) .msi file in the following directory:

C:\Windows\Installer

A low privileged attacker can start the installer in repair mode (which is then running with SYSTEM privileges) without UAC popping up, by using the following command:

msiexec.exe /fa C:\Installer\<installer name>.msi

At the end of the repair process, three sub-processes (certutil.exe), called by MSI custom actions, perform the following operations:

[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-root-certificate-authority.cer"
[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-certificate-authority.cer"
[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-root-certificate-authority_2021-2036.cer" 

The previously mentioned operations get executed in a conhost.exe window in the context of NT AUTHORITY\SYSTEM. The attacker can use the appearing conhost.exe windows to get an elevated command prompt. Therefore, the attacker has to interrupt the execution flow of one of the certutil operations before the conhost.exe window closes. This can be done by locking the file operations on one of the following files:  

notarius-root-certificate-authority.cer
notarius-certificate-authority.cer 
notarius-root-certificate-authority_2021-2036.cer

For this purpose, the attacker can use SetOpLock.exe from the following source:

https://github.com/googleprojectzero/symboliclink-testing-tools

To lock all operations on one of the previously mentioned files, the attacker has to use the following syntax:

while ($true) {
	 .\SetOpLock.exe <Path> x 
}

For example, to lock the operations on the first of the mentioned files, the following command loop can be used:

while ($true) {
	.\SetOpLock.exe "C:\Program Files\Nitro\PDF Pro\14\notarius-root-certificate-authority.cer" x 
}

The tool will lock any operation on the file until the attacker presses Enter. While executing the previously mentioned msiexec-command, multiple operation locks will get triggered. The attacker has to skip multiple of them (by pressing Enter) until a conhost.exe window opens. The conhost.exe process is running with SYSTEM privileges and can be used to escalate privileges. The following steps have to be conducted:

1. Right click on the top bar of the conhost.exe window.

2. Click on "Properties".

3. Under options, click on the "Legacyconsolemode" link.

4. Open the link with a browser other than Internet Explorer or Edge (both don't open as SYSTEM in Windows 11).

5. In the opened browser window press the key combination "CTRL+o".

6. Type "C:\Windows\System32\cmd.exe" in the top bar and press Enter.

A command prompt should open with the user permission context of NT AUTHORITY\SYSTEM. The privileges have been escalated and the system is fully compromised.

Vulnerable / tested versions

The following version has been tested which was the latest version available at the time of the test:

• Nitro PDF Pro 14.18.1.41

According to the vendor, version branch 13 is also affected. The vendor confirmed that the following versions are vulnerable:

• Nitro PDF Pro <14.26.1.0
• Nitro PDF Pro <13.70.8.82

Vendor contact timeline