{"uuid": "affe6873-45b8-489e-a081-e739d6bb8c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28546", "type": "seen", "source": "https://t.me/hacking_Attack/10387", "content": "Black Hat Ethical Hacking\nPDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature \u2018Certified\u2019 Widely Vulnerable to AttackPost Views: 161 \nReading Time: 1 Minute\nCertified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents\u2019 integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.\nResearchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.\n\nUnsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, \u201cEvil Annotation\u201d (EAA) and \u201cSneaky Signature\u201d (SSA). Both allow an attacker to overlay malicious content\u00a0(PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document\u2019s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.\n\nThe team said the results of its evaluation of the 26 most popular PDF applications were \u201calarming.\u201d\nSee Also: Pulse Secure VPNs Get Quick Fix for Critical RCE \u201cIn only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,\u201d the report said. \u201cWe additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.\u201d\n\nAdobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.\n\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg \u201cFor example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.\n\nThe team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws\u00a0found in each application.\n\n\u201cAdobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),\u201d the report said. \u201cAdobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.\u201d\nSee Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, \u201cFreeText, Stamp and Redact.\u201d\n\nSneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won\u2019t g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.015912Z"}