SumatraPDF 3.5.2 - Remote Code Execution

ExploitDBExploitDB exploitScannerEDB-52535

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Flask-based server that impersonates the SumatraPDF update endpoint. It serves a fake update response pointing to a dummy executable, but does not perform the network interception (MITM) required to redirect the victim's traffic. It only demonstrates the server-side component of the attack chain.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Flask server that serves a fake update response and a dummy executable to demonstrate the CVE-2026-25961 MITM attack. It contains no concealed behavior, persistence mechanisms, credential theft, or unrelated payloads. The dummy payload is explicitly labeled as fake and non-functional.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareSumatraPDF
Attack typesman-in-the-middle
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code only provides the server-side component that would serve a malicious update and payload if the attacker already has a MITM position. It does not include any capability to intercept, redirect, or poison the victim's network traffic, which is explicitly stated as a prerequisite. Therefore, it cannot independently exploit the vulnerability; it only demonstrates or validates the server-side behavior.

exploits/multiple/webapps/52535.py:25-26exploits/multiple/webapps/52535.py:36-37

Requirements

  • Attacker must achieve a network position to intercept or redirect the victim's update check request (e.g., DNS spoofing, rogue AP, router compromise).exploits/multiple/webapps/52535.py:25-26
  • Victim must manually trigger the update check (Help → Check for updates) and click Install.exploits/multiple/webapps/52535.py:32-33

Observed behavior

  • Starts a Flask web server on port 5000.exploits/multiple/webapps/52535.py:87
  • Serves a fake update-check-rel.txt response containing a URL to a malicious installer hosted on the same server.exploits/multiple/webapps/52535.py:58-65
  • Serves a dummy executable (malicious_installer.exe) when requested.exploits/multiple/webapps/52535.py:67-76
  • Generates a non-functional dummy payload if the payload file does not exist.exploits/multiple/webapps/52535.py:52-56
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Dummy Payload
MZ\x90*200FAKE PAYLOAD - replace with real shellcodeThe script generates a non-functional dummy executable if none exists, explicitly instructing the user to replace it with a real payload. This is standard PoC behavior and not a backdoor.exploits/multiple/webapps/52535.py:52-56
Network Service
Flask server on 0.0.0.0:5000The server listens on all interfaces to serve the fake update and payload, as required for the MITM demonstration. No hidden listeners or reverse connections are established.exploits/multiple/webapps/52535.py:78-87
Review boundaries

What the analysis did not establish

  • The artifact does not include the MITM, DNS spoofing, or traffic redirection component required to complete the attack.
  • The dummy payload is non-functional and explicitly marked as a placeholder.
  • Only the supplied Python script was reviewed; no external dependencies or referenced resources were inspected.
  • The dummy payload is not executed or analyzed beyond its textual representation in the script.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1