CVE-2017-7442
HIGHNitro Pro 11.0.3.173 - Remote Code Execution via Directory Traversal in saveAs and launchURL
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-7442.
PoCs published by Metasploit, including Metasploit module exploits/windows/fileformat/nitro_reader_jsapi.
AI-analyzed exploit summary This Metasploit module exploits CVE-2017-7442 in Nitro Pro PDF Reader 11.0.3.173 by leveraging unsafe JavaScript APIs (saveAs and launchURL) to write arbitrary files and execute them, achieving remote code execution.
Description
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
Exploits (2)
This Metasploit module exploits CVE-2017-7442 in Nitro Pro PDF Reader 11.0.3.173 by leveraging unsafe JavaScript APIs (saveAs and launchURL) to write arbitrary files and execute them, achieving remote code execution.
This Metasploit module exploits an unsafe JavaScript API in Nitro Pro PDF Reader 11.0.3.173, allowing arbitrary file writes via saveAs() and local file execution via launchURL() to achieve remote code execution.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H