Improper input validation in Foxit PDF Editor (formerly Foxit PhantomPDF) - #VU8223
Published: September 11, 2017 / Updated: September 11, 2017
Vulnerability identifier: #VU8223
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write arbitrary files on the target system.
The weakness exists due to input validation flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the createDataObject function call, create arbitrary executable file in the local file system and execute arbitrary code.
The weakness exists due to input validation flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the createDataObject function call, create arbitrary executable file in the local file system and execute arbitrary code.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Remediation
Update to version 7.3.17.