Summary

The PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”.
This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click.

Details

The “Show in folder” functionality is expected to safely invoke the system file explorer using a trusted, absolute path from the system directory. However, the application instead resolves and executes explorer.exe relative to the directory containing the currently opened PDF file first.

An attacker can exploit this behavior by placing a malicious explorer.exe in the same directory as a crafted PDF file. When the victim opens the PDF and selects File → “Show in folder”, the application executes the attacker-controlled binary instead of the legitimate system explorer.

This indicates improper handling of executable paths and reliance on an untrusted working directory, resulting in binary hijacking.

PoC

1. Create a malicious executable named explorer.exe which lanches explorer.exe in the path specified and calc.exe.
2. Place this executable in the same directory as a PDF file.
3. Open the PDF file.
4. From the menu, select File → “Show in folder”.
5. Observe that the malicious explorer.exe is executed instead of the legitimate system file explorer

PoC video:

Impact

This is a local arbitrary code execution vulnerability via binary hijacking. Any user who opens a PDF from an poisoned directory is impacted. An attacker could leverage this issue to execute malware, establish persistence or perform further actions on the victim’s system under the context of the logged-in user.