CVE-2018-9948
published 2018-05-17CVE-2018-9948: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is…
PriorityP262medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EXPLOIT
EPSS
64.07%
99.1th percentile
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of typed arrays. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5380.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foxit | foxit_reader | — | — |
| foxitsoftware | foxit_reader | <= 9.0.1.1049 | — |
| foxitsoftware | phantompdf | <= 9.0.1.1049 | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://srcincite.io/blog/2018/06/22/foxes-among-us-foxit-reader-vulnerability-discovery-and-exploitation.html↗
- →The exploit delivers a malicious PDF file; hunt for PDF files opened by Foxit Reader that trigger TypedArray uninitialized pointer access or Text Annotation UAF behaviour. ↗
- →The Metasploit module uses an SMB share to host and deliver a payload EXE; monitor for Foxit Reader processes initiating outbound SMB connections (port 445) to remote hosts, which is anomalous and indicative of exploitation. ↗
- →The exploit combines CVE-2018-9948 (uninitialized pointer / TypedArray) with CVE-2018-9958 (Text Annotation UAF) to leak a vtable address and build a ROP chain; detection should look for Foxit Reader spawning unexpected child processes after opening a PDF. ↗
- →Default Metasploit payload for this module is windows/meterpreter/reverse_tcp; alert on Foxit Reader process establishing outbound TCP connections consistent with Meterpreter staging. ↗
- →The exploit targets Windows 10 Pro x64 Build 17134 and requires insecure logons enabled on Windows 10 Enterprise; this configuration detail can be used to scope detection priority. ↗
- ·Exploitation requires user interaction — the target must open a malicious PDF file or visit a malicious page; drive-by exploitation without user action is not possible. ↗
- ·On Windows 10 Enterprise, the SMB-based payload delivery requires insecure logons to be enabled; without this setting the exploit will not work as expected. ↗
- ·The generated SMB share path must not exceed 44 bytes or the exploit module will abort with a BadConfig failure. ↗
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
exploitdb·2018-08-27
CVE-2018-9958 Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Foxit PDF Reader Pointer Overwrite UAF',
'Description' => %q{
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
},
'License' => MSF_LICENSE,
'Author' =>
[
'mr_me', # Use-after-free and PoC
'bit from meepwn', # Uninitialized pointer
'
Exploit-DB
Foxit Reader 9.0.1.1049 - Remote Code Execution
exploitdb·2018-06-25·CVSS 6.5
CVE-2018-9958 [MEDIUM] Foxit Reader 9.0.1.1049 - Remote Code Execution
Foxit Reader 9.0.1.1049 - Remote Code Execution
---
%PDF
1 0 obj
>
2 0 obj
> trailer >
Metasploit
Foxit PDF Reader Pointer Overwrite UAF
metasploit
Foxit PDF Reader Pointer Overwrite UAF
Foxit PDF Reader Pointer Overwrite UAF
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain can be constructed that will execute when Foxit Reader performs the UAF. This module has been tested on Windows 7 x64, Windows 10 Pro x64 Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise must have insecure logons enabled for the exploit to work as expected.
No writeups or analysis indexed.
https://www.exploit-db.com/exploits/44941/https://www.exploit-db.com/exploits/45269/https://www.foxitsoftware.com/support/security-bulletins.phphttps://zerodayinitiative.com/advisories/ZDI-18-332https://www.exploit-db.com/exploits/44941/https://www.exploit-db.com/exploits/45269/https://www.foxitsoftware.com/support/security-bulletins.phphttps://zerodayinitiative.com/advisories/ZDI-18-332
2018-05-17
Published