Foxit Reader bug lets attackers run malicious code via PDFs

Foxit Software, the company behind the highly popular Foxit Reader, has published security updates to fix a high severity remote code execution (RCE) vulnerability affecting the PDF reader.

This security flaw could allow attackers to run malicious code on users' Windows computers and, potentially, take over control.

Foxit claims to have more than 650 million users from 200 countries, with its software currently being used by over 100,000 customers.

The company's extensive enterprise customer list contains multiple high-profile tech companies, including Google, Intel, NASDAQ, Chevron, British Airways, Dell, HP, Lenovo, and Asus.

Use after free weakness exposes users to RCE attacks

The high-severity vulnerability (tracked a CVE-2021-21822) results from a Use After Free bug found by Aleksandar Nikolic of Cisco Talos in the V8 JavaScript engine used by Foxit Reader to display dynamic forms and interactive document elements.

Successful exploitation of use after free bugs can lead to unexpected results ranging from program crashes and data corruption to the execution of arbitrary code on computers running the vulnerable software.

This security flaw is caused by how the Foxit Reader application and browser extensions handle certain annotation types, which attackers can abuse to craft malicious PDFs that will allow them to run arbitrary code via precise memory control.

"A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution," Nikolic explained.

"An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled."

The vulnerability impacts Foxit Reader 10.1.3.37598 and earlier versions, and it was addressed with the release of Foxit Reader 10.1.4.37651.

To defend against CVE-2021-21822 attacks, you have to download the latest Foxit Reader version and then click on "Check for Updates" in the app's “Help” dialog.

More vulnerabilities fixed in Foxit Reader 10.1.4

Foxit fixed several other security bugs impacting previous Foxit Reader versions in the latest release, exposing users' devices to denial of service, remote code execution, information disclosure, SQL injection, DLL hijacking, and other vulnerabilities.

The complete list of security fixes in the Foxit Reader 10.1.4 release includes:

Issues where the application could be exposed to Memory Corruption vulnerability and crash when exporting certain PDF files to other formats. Issues where the application could be exposed to Denial of Service vulnerability and crash when handling certain XFA forms or link objects. Issues where the application could be exposed to Denial of Service, Null Pointer Reference, Out-of-Bounds Read, Context Level Bypass, Type Confusion, or Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code. Issue where the application could be exposed to Arbitrary File Deletion vulnerability due to improper access control. Issue where the application could deliver incorrect signature information for certain PDF files that contained invisible digital signatures. Issues where the application could be exposed to DLL Hijacking vulnerability when it was launched, which could be exploited by attackers to execute remote code by placing a malicious DLL in the specified path directory. Issues where the application could be exposed to Out-of-Bounds Write/Read Remote Code Execution or Information Disclosure vulnerability and crash when handling certain JavaScripts or XFA forms. Issue where the application could be exposed to Out-of-Bounds Write vulnerability when parsing certain PDF files that contain nonstandard /Size key value in the Trailer dictionary. Issue where the application could be exposed to Out-of-Bounds, Write vulnerability and crash when converting certain PDF files to Microsoft Office files. Issues where the application could be exposed to Arbitrary File Write Remote Code Execution vulnerability when executing certain JavaScripts. Issues where the application could be exposed to SQL Injection Remote Code Execution vulnerability. Issue where the application could be exposed to Uninitialized Variable Information Disclosure vulnerability and crash. Issues where the application could be exposed to Out-of-Bounds Read or Heap-based Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code or disclose sensitive information.

Two years ago, Foxit disclosed a data breach stemming from unauthorized third parties accessing the personal information of 328,549 'My Account' service users, including customer and company names, emails, phone numbers, and passwords.