Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 10.1.12. It is, therefore affected by multiple vulnerabilities:

  - Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability     when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in     the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can     execute arbitrary code after a restart. (CVE-2023-27363)

  - Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability     and crash when parsing certain XLS or DOC files. This occurs as the application opens the XLS or DOC file     with the default permissions and allows for the execution of macros without proper restrictions or     consents from users.  (CVE-2023-27364, CVE-2023-27365)

  - Addressed potential issues where the application could be exposed to Null Pointer Dereference or Use-     after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This     occurs due to the access of null pointer or freed memory without proper validation when handling certain     JavaScripts. (CVE-2023-27366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PDF Editor application (previously named Foxit PhantomPDF) installed on the remote Windows host is prior to 11.2.6. It is, therefore affected by multiple vulnerabilities:

  - Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability     when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in     the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can     execute arbitrary code after a restart. (CVE-2023-27363)

  - Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability     and crash when parsing certain XLS or DOC files. This occurs as the application opens the XLS or DOC file     with the default permissions and allows for the execution of macros without proper restrictions or     consents from users.  (CVE-2023-27364, CVE-2023-27365)

  - Addressed potential issues where the application could be exposed to Null Pointer Dereference or Use-     after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This     occurs due to the access of null pointer or freed memory without proper validation when handling certain     JavaScripts. (CVE-2023-27366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PDF Reader application (previously named Foxit Reader) installed on the remote Windows host is prior to 12.1.2. It is, therefore affected by multiple vulnerabilities:

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PDF Editor application (previously named Foxit PhantomPDF) installed on the remote Windows host is prior to 12.1.2. It is, therefore affected by multiple vulnerabilities:

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177391	Foxit PhantomPDF < 10.1.12 Multiple Vulnerabilities	Nessus	Windows	high
176520	Foxit PDF Editor < 11.2.6 Multiple Vulnerabilities	Nessus	Windows	high
174706	Foxit PDF Reader < 12.1.2 Multiple Vulnerabilities	Nessus	Windows	high
174705	Foxit PDF Editor < 12.1.2 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2023-27363

high

Tenable Plugins

high

high

high

high