FortiEDR coverage: PoolParty Code Injection Technique

Read Time:59 Second

What is the Attack?

On December 6, researchers from SafeBreach published a new code injection technique for Windows OS called “Pool Party” in the Blackhat EU briefing.

The “Pool Party” technique allows injecting processes using the WINAPI thread pool and relies on the fact that every process has an automatically enabled thread pool. It then uses the API on the target process to add new routines to the existing thread pool.

Why is this Significant?

The new injection technique implements eight different variants. These have been tested by SafeBreach researchers against 5 leading EDR products and reported to be effective in evading them.

Currently, no threat actors have been identified using this technique.

What is the Status of Coverage?

FortiEDR blocks all PoolParty variants out of the box.

FortiEDR’s injection detection does not rely on a specific API being called, but rather on a kernel behavior detection policy that allows unknown techniques to be detected.

Malicious actions by the injected threads, such as attempting to connect to C2, will be blocked by EDR.

FortiEDR customers with Collector versions 5.2.0 and 5.2.2 are protected with no update required to Collector or Content.

Read More

ZDI-24-002: Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Read Time:17 Second

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2023-51564.

Read More

ZDI-24-004: Kofax Power PDF OXPS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Read Time:17 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2023-51566.

Read More

ZDI-24-005: Kofax Power PDF OXPS File Parsing Use-After-Free Information Disclosure Vulnerability

Read Time:17 Second

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2023-51568.

Read More

ZDI-24-006: Kofax Power PDF OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Read Time:17 Second

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2023-51567.

Read More

ZDI-24-009: X.Org Server RRChangeOutputProperty Integer Overflow Information Disclosure Vulnerability

Read Time:17 Second

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2023-6478.

Read More