Description
Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Foxit Software | Foxit PDF Reader | < 4.3.1.0218 | 4.3.1.0218 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Foxit PDF Reader 4.2 Javascript File Write
exploit/windows/fileformat/foxit_reader_filewrite
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rb exploit
- https://www.exploit-db.com/exploits/16978 exploit
- http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html technical-description exploit
- https://www.foxit.com/pdf-reader/version-history.html vendor-advisory patch
- https://www.vulncheck.com/advisories/foxit-pdf-reader-javascript-file-write third-party-advisory