CVE-2018-9958
published 2018-05-17CVE-2018-9958: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to…
PriorityP274high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
63.31%
99.1th percentile
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Text Annotations. When setting the point attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5620.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foxit | foxit_reader | — | — |
| foxitsoftware | foxit_reader | <= 9.0.1.1049 | — |
| foxitsoftware | phantompdf | <= 9.0.1.1049 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit checks app.platform == 'WIN', app.isFoxit == 'Foxit Reader', and app.appFoxitVersion == '9.0.1.1049' before executing — these JavaScript property checks in a PDF can be used as a detection signature. ↗
- →Metasploit module uses a UNC/SMB share path (up to 44 bytes) embedded in the PDF ROP chain to download and execute a payload EXE — detect PDF files containing UNC paths (\\<host>\<share>\<file>.exe) within JavaScript or stream content. ↗
- →The exploit combines a UAF in Text Annotations with uninitialized TypedArray pointers to leak a vtable address and construct a ROP chain — look for Foxit Reader processes crashing or spawning child processes after opening a PDF with JavaScript. ↗
- →Default Metasploit payload for this module is windows/meterpreter/reverse_tcp — correlate Foxit Reader spawning network connections after PDF open. ↗
- ·Windows 10 Enterprise targets require insecure logons to be enabled for the exploit to work as expected. ↗
- ·The SMB share path embedded in the ROP chain must not exceed 44 bytes or the exploit will fail. ↗
- ·User interaction is required — the target must visit a malicious page or open a malicious file for exploitation. ↗
- ·The exploit was tested on Windows 7 x64, Windows 10 Pro x64 Build 17134, and Windows 10 Enterprise x64 only. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Foxit Reader 9.0.1.1049 - Arbitrary Code Execution
exploitdb·2020-11-27·CVSS 8.8
CVE-2018-9958 [HIGH] Foxit Reader 9.0.1.1049 - Arbitrary Code Execution
Foxit Reader 9.0.1.1049 - Arbitrary Code Execution
---
# Exploit Title: Foxit Reader 9.0.1.1049 - Arbitrary Code Execution
# Date: 2020-08-29
# Exploit Author: CrossWire
# Vendor Homepage: https://www.foxitsoftware.com/
# Software Link: https://www.foxitsoftware.com/downloads/latest.php?product=Foxit-Reader&platform=Windows&version=9.0.1.1049&package_type=exe&language=English
# Version: 9.0.1.1049
# Tested on: Microsoft Windows Server 2016 10.0.14393
# CVE : [2018-9958](https://nvd.nist.gov/vuln/detail/CVE-2018-9958)
#!/usr/bin/python3
'''
| PDF generator for Foxit Reader Remote Code Execution (CVE 2018-9958) |
| Written by: Kevin Dorland (CrossWire) |
| Date: 08/29/2020 |
| |
| Exploit originally discovered by Steven Seeley (mr_me) of Source Incite |
| |
| References: |
| https://www.
Exploit-DB
Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
exploitdb·2018-08-27
CVE-2018-9958 Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Foxit PDF Reader Pointer Overwrite UAF',
'Description' => %q{
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
},
'License' => MSF_LICENSE,
'Author' =>
[
'mr_me', # Use-after-free and PoC
'bit from meepwn', # Uninitialized pointer
'
Exploit-DB
Foxit Reader 9.0.1.1049 - Remote Code Execution
exploitdb·2018-06-25·CVSS 6.5
CVE-2018-9958 [MEDIUM] Foxit Reader 9.0.1.1049 - Remote Code Execution
Foxit Reader 9.0.1.1049 - Remote Code Execution
---
%PDF
1 0 obj
>
2 0 obj
> trailer >
Metasploit
Foxit PDF Reader Pointer Overwrite UAF
metasploit
Foxit PDF Reader Pointer Overwrite UAF
Foxit PDF Reader Pointer Overwrite UAF
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain can be constructed that will execute when Foxit Reader performs the UAF. This module has been tested on Windows 7 x64, Windows 10 Pro x64 Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise must have insecure logons enabled for the exploit to work as expected.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/160240/Foxit-Reader-9.0.1.1049-Arbitrary-Code-Execution.htmlhttps://www.exploit-db.com/exploits/44941/https://www.exploit-db.com/exploits/45269/https://www.foxitsoftware.com/support/security-bulletins.phphttps://zerodayinitiative.com/advisories/ZDI-18-342http://packetstormsecurity.com/files/160240/Foxit-Reader-9.0.1.1049-Arbitrary-Code-Execution.htmlhttps://www.exploit-db.com/exploits/44941/https://www.exploit-db.com/exploits/45269/https://www.foxitsoftware.com/support/security-bulletins.phphttps://zerodayinitiative.com/advisories/ZDI-18-342
2018-05-17
Published