CVE-2020-9715 EDR Validation PoC

Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only.

Vulnerability

Adobe Acrobat Reader DC <= 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding (ANSI or Unicode). Deletion always constructs Unicode keys, so ANSI-named entries are never purged from the cache. After GC frees the underlying object, the stale cache entry becomes a dangling pointer.

What the PoC Does

1. Embeds a data object with an ANSI-encoded name in the PDF
2. JavaScript OpenAction accesses dataObjects to populate the ESObject cache
3. Removes the reference and forces garbage collection
4. Heap sprays with ArrayBuffer allocations to reclaim the freed memory
5. Re-accesses the stale cached ESObject, triggering the use-after-free

This PoC triggers the vulnerability pattern but does not include a weaponized payload (no shellcode, no ROP chain). It is designed to validate whether your EDR detects the exploitation technique.

Usage

python generate_poc.py              # Generates CVE-2020-9715.pdf
python generate_poc.py -o custom.pdf  # Custom output path

No external dependencies -- uses only Python standard library.

Testing

1. Generate the PDF on your workstation
2. Transfer it to the gold image test machine
3. Open in Adobe Acrobat Reader DC
4. Observe EDR behavior:
   • PASS: EDR blocks/alerts on the JS heap spray + UAF access pattern
   • FAIL: PDF opens without EDR intervention, Reader may crash

EDR Detection Signals

Your EDR should key on one or more of:

• JavaScript heap spray pattern (ArrayBuffer mass allocation)
• dataObjects access followed by forced GC and re-access (UAF pattern)
• Known CVE-2020-9715 signature in embedded JS
• Suspicious PDF structure: OpenAction + EmbeddedFiles + JavaScript

Affected Versions

• Adobe Acrobat Reader DC <= 2020.009.20063
• Adobe Acrobat Reader 2017 <= 2017.011.30171
• Adobe Acrobat Reader 2015 <= 2015.006.30523

Patched in APSB20-48 (August 2020).