HTTP: Foxit Reader and PhantonPDF XFA gotoURL Command Injection

A command injection vulnerability has been reported in the XFA component of Foxit Reader and PhantomPDF. A remote attacker could exploit this vulnerability by enticing a victim user to visit a malicious web page or open a crafted PDF document. Successful exploitation could allow the attacker to execute arbitrary command under the context of the user.

Extended Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the gotoURL method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5030.

Affected Products

Foxitsoftware foxit_reader

References

CVE: CVE-2017-10953

URL: https://www.foxitsoftware.com/support/security-bulletins.php

Short Name

HTTP:STC:FOXIT-READER-CMDINJ

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Foxit Reader and PhantonPDF XFA gotoURL Command Injection

Extended Description

Affected Products

References

Found a potential security threat?