CVE-2019-13333
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Foxit PhantomPDF installations by tricking users into opening malicious DXF files. The flaw exists in the DXF-to-PDF conversion process due to improper input validation, leading to an out-of-bounds write. Users of vulnerable Foxit PhantomPDF versions are affected.
💻 Affected Systems
- Foxit PhantomPDF
📦 What is this software?
Phantompdf by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution with the privileges of the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Attacker gains code execution on the user's system through a malicious DXF file, enabling data exfiltration, credential theft, or malware installation.
If Mitigated
If proper controls like application whitelisting and least privilege are in place, impact is limited to the current user's context without administrative privileges.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious DXF file is opened. ZDI-CAN-8773 identifier suggests detailed research exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Foxit PhantomPDF 9.5.1 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Download latest version from Foxit website. 2. Run installer. 3. Restart system after installation.
🔧 Temporary Workarounds
Disable DXF file association
windowsPrevent Foxit PhantomPDF from automatically opening DXF files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dxf to open with different application
Block DXF files at perimeter
allPrevent DXF files from entering network via email or web
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Run Foxit PhantomPDF with restricted user privileges (non-admin)
🔍 How to Verify
Check if Vulnerable:
Check Foxit PhantomPDF version in Help > About. If version is 9.5.0.20723 or earlier, system is vulnerable.Check Version:
wmic product where name="Foxit PhantomPDF" get versionVerify Fix Applied:
Verify version is 9.5.1 or later in Help > About. Test opening known safe DXF files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Process creation events for Foxit PhantomPDF with DXF file arguments
- Application crash logs from Foxit PhantomPDF
Network Indicators:
- Inbound DXF files via email or web downloads
- Outbound connections from Foxit PhantomPDF process to unknown IPs
SIEM Query:
source="windows" event_id=4688 process_name="*phantom*" command_line="*.dxf*"