CVE-2020-13806
📋 TL;DR
CVE-2020-13806 is a use-after-free vulnerability in Foxit Reader and PhantomPDF that occurs when JavaScript executes after document deletion or closure. This allows attackers to execute arbitrary code by tricking users into opening malicious PDF files. All users of affected Foxit software versions are vulnerable.
💻 Affected Systems
- Foxit Reader
- Foxit PhantomPDF
📦 What is this software?
Phantompdf by Foxitsoftware
Reader by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the current user, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Malicious PDF files delivered via email or web downloads execute arbitrary code, install malware, or steal sensitive information from the victim's system.
If Mitigated
With proper security controls, exploitation attempts are blocked by endpoint protection, and user impact is limited to application crashes.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious PDF file. Multiple proof-of-concept examples exist in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.7.2 and later
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.php
Restart Required: Yes
Instructions:
1. Download Foxit Reader/PhantomPDF 9.7.2 or later from official Foxit website. 2. Run the installer. 3. Follow installation prompts. 4. Restart the application and system if prompted.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents JavaScript execution in PDF files, which blocks the exploitation vector
Open Foxit Reader > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use alternative PDF reader
allTemporarily switch to a different PDF reader application
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized executables
- Deploy endpoint detection and response (EDR) solutions to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Foxit version: Open Foxit Reader > Help > About Foxit Reader. If version is below 9.7.2, you are vulnerable.Check Version:
On Windows: wmic product where "name like 'Foxit%'" get versionVerify Fix Applied:
Verify version is 9.7.2 or higher in Help > About Foxit Reader. Test with known safe PDF files containing JavaScript.📡 Detection & Monitoring
Log Indicators:
- Application crashes in Foxit Reader/PhantomPDF
- Unexpected child processes spawned from Foxit
- JavaScript execution errors in application logs
Network Indicators:
- Downloads of PDF files from suspicious sources
- Outbound connections from Foxit process to unknown IPs
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR parent_process_name:"FoxitReader.exe")