CVE-2020-13811
📋 TL;DR
This vulnerability in Foxit Studio Photo allows attackers to execute arbitrary code by exploiting an out-of-bounds write vulnerability when processing specially crafted TIFF image files. Users of Foxit Studio Photo versions before 3.6.6.922 are affected, potentially leading to system compromise.
💻 Affected Systems
- Foxit Studio Photo
📦 What is this software?
Foxit Studio Photo by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to complete system compromise, data theft, and lateral movement.
Likely Case
Local privilege escalation or application crash when user opens malicious TIFF file, potentially leading to malware installation.
If Mitigated
Application crash without code execution if memory protections are enabled, but denial of service still occurs.
🎯 Exploit Status
Exploitation requires user to open malicious TIFF file; file format vulnerabilities are commonly weaponized in phishing campaigns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.6.922 or later
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.php
Restart Required: Yes
Instructions:
1. Download latest version from Foxit website. 2. Run installer. 3. Restart system. 4. Verify version is 3.6.6.922 or higher.
🔧 Temporary Workarounds
Disable TIFF file association
windowsRemove Foxit Studio Photo as default handler for TIFF files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .tiff/.tif > Change program
Block TIFF files at perimeter
allFilter TIFF files at email gateways and web proxies
🧯 If You Can't Patch
- Restrict user permissions to prevent execution of arbitrary code
- Implement application whitelisting to block unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Foxit Studio Photo for version numberCheck Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Confirm version is 3.6.6.922 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected child processes spawned from FoxitStudioPhoto.exe
Network Indicators:
- Downloads of TIFF files from untrusted sources
- Outbound connections after opening TIFF files
SIEM Query:
process_name:"FoxitStudioPhoto.exe" AND (event_id:1000 OR event_id:1001) OR file_extension:".tif" OR file_extension:".tiff"