Uncovering the Ongoing Exploitation of Acrobat Reader Zero-Day Vulnerability by Hackers

Recently, attackers have been taking advantage of a zero-day vulnerability in Adobe Reader by using specially crafted PDF documents. This exploit has been active since at least December, affecting Adobe users worldwide.

The discovery of these attacks was made by security researcher Haifei Li, the founder of EXPMON, a platform that focuses on detecting exploits using sandbox technology. Li highlighted the sophistication of the attack, describing it as a “highly sophisticated, fingerprinting-style PDF exploit” that targets an undisclosed security flaw in Adobe Reader.

According to Li, the attackers have been targeting Adobe users for over four months, utilizing privileged Acrobat APIs like util.readFileIntoStream and RSS.addFeed to steal data from compromised systems. Additionally, they have been deploying additional exploits to further compromise the systems.

Li also warned that the exploit leverages a zero-day vulnerability that works on the latest version of Adobe Reader without requiring any user interaction beyond opening a PDF file. This exploit not only collects local information but also opens the door for potential remote code execution (RCE) attacks, giving the attacker full control of the victim’s system.

Having disclosed numerous security vulnerabilities in software from companies like Microsoft, Google, and Adobe, Li has a history of uncovering exploits used in zero-day attacks.

Russian-language phishing lures

Another security analyst, Gi7w0rm, who examined the Adobe Reader exploit, found that the PDF documents used in these attacks contain Russian-language content related to events in the Russian oil and gas industry.

Li has informed Adobe about these findings and recommended that Adobe Reader users avoid opening PDF documents from untrusted sources until a security patch is released. To mitigate the risk of attacks exploiting this zero-day vulnerability, network defenders can monitor and block HTTP/HTTPS traffic containing the “Adobe Synchronizer” string in the User-Agent header.

Li emphasized the need for the security community to stay vigilant due to the potential for broad information harvesting and subsequent exploitation through RCE attacks. He urged users to remain cautious and proactive in protecting their systems.

When contacted for a response to Li’s findings, Adobe had not provided a statement at the time of writing.

An automated pentesting approach demonstrates the existence of vulnerabilities, while a Business Application Security (BAS) assessment determines whether existing controls can prevent them. It is essential to run both tests to ensure comprehensive security.

This whitepaper outlines six validation surfaces, identifies coverage gaps, and offers three key questions for evaluating security tools.

Get Your Copy Now