CVE-2018-20310
📋 TL;DR
This vulnerability in Foxit Reader and PhantomPDF involves a race condition in the proxyDoAction function that can lead to stack-based buffer overflow or out-of-bounds read. Attackers could exploit this to execute arbitrary code or cause denial of service. Users of affected Foxit software versions are at risk.
💻 Affected Systems
- Foxit Reader
- Foxit PhantomPDF
📦 What is this software?
Phantompdf by Foxitsoftware
Phantompdf by Foxitsoftware
Reader by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited information disclosure through memory reads.
If Mitigated
Application crash with no data loss if sandboxing or exploit mitigations are effective.
🎯 Exploit Status
Race condition exploitation requires timing precision but has been demonstrated in proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Foxit Reader 9.5+, PhantomPDF 8.3.10+ or 9.5+
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.php
Restart Required: No
Instructions:
1. Download latest version from Foxit website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 9.5 or higher for Reader, or 8.3.10/9.5+ for PhantomPDF.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents exploitation via malicious JavaScript in PDFs
Open Foxit > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use alternative PDF reader
allTemporarily switch to non-vulnerable PDF software
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized Foxit execution
- Deploy enhanced exploit mitigation (EMET, Windows Defender Exploit Guard)
🔍 How to Verify
Check if Vulnerable:
Check Foxit version via Help > About. If Reader version < 9.5 or PhantomPDF version < 8.3.10/9.5, system is vulnerable.Check Version:
On Windows: wmic product where name like "Foxit%" get versionVerify Fix Applied:
Confirm version is Reader 9.5+ or PhantomPDF 8.3.10+/9.5+ in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes of Foxit processes
- Unusual process creation from Foxit executables
Network Indicators:
- Downloads of PDF files from suspicious sources
- Outbound connections after PDF opening
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR event_id:1001)