CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-nitro-pdf-pro/
https://seclists.org/fulldisclosure/2024/Sep/59
https://www.gonitro.com/support/downloads#securityUpdates
http://seclists.org/fulldisclosure/2024/Sep/59

Configurations

No configuration.

History

No history.

Information

Published : 2024-10-09 04:15

Updated : 2026-06-17 07:34

NVD link : CVE-2024-35288

Mitre link : CVE-2024-35288

CVE.ORG link : CVE-2024-35288

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-35288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35288", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-10-09T20:19:05.765322Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:gonitro:nitro_pdf_pro:*:*:*:*:*:*:*:*"], "vendor": "gonitro", "product": "nitro_pdf_pro", "versions": [{"status": "affected", "version": "0", "lessThan": "13.70.8.82", "versionType": "custom"}, {"status": "affected", "version": "14.0", "lessThan": "14.26.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2024-10-09T04:15:08.233", "references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-nitro-pdf-pro/", "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2024/Sep/59", "source": "cve@mitre.org"}, {"url": "https://www.gonitro.com/support/downloads#securityUpdates", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2024/Sep/59", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\\SYSTEM."}, {"lang": "es", "value": "Las versiones anteriores a la 13.70.8.82 y 14.x anteriores a la 14.26.1.0 de Nitro PDF Pro permiten la escalada de privilegios locales en el instalador MSI porque las acciones personalizadas se ejecutan de forma insegura en el modo de reparaci\u00f3n. CertUtil se ejecuta en una ventana conhost.exe y hay un mecanismo que permite que CTRL+o inicie cmd.exe como NT AUTHORITY\\SYSTEM."}], "lastModified": "2026-06-17T07:34:41.753", "sourceIdentifier": "cve@mitre.org"}