Command injection in Foxit PDF Editor (formerly Foxit PhantomPDF) - #VU8221
Published: September 11, 2017 / Updated: September 11, 2017
Vulnerability identifier: #VU8221
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Foxit Software Inc.
Affected software:
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Editor (formerly Foxit PhantomPDF)
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The weakness exists due to command injection flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the app.launchURL JavaScript call, inject arbitrary commands and execute arbitrary code.
The weakness exists due to command injection flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the app.launchURL JavaScript call, inject arbitrary commands and execute arbitrary code.
Remediation
Update to version 7.3.17.