CVE-2021-34845
📋 TL;DR
This vulnerability in Foxit PDF Reader allows remote attackers to execute arbitrary code by tricking users into opening malicious PDF files. The flaw exists in how Annotation objects are handled without proper validation, leading to use-after-free conditions. All users running affected versions of Foxit PDF Reader are at risk.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
Pdf Editor by Foxitsoftware
Pdf Editor by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious code execution in the context of the PDF reader process, allowing file system access, credential harvesting, and further malware installation.
If Mitigated
Limited impact if running with reduced privileges, but still potential for local data access and limited system interaction.
🎯 Exploit Status
Exploit requires user to open malicious PDF file. ZDI has published technical details and proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.1.49944 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest version. 4. Restart application.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents JavaScript-based exploitation vectors
File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
allOpen untrusted PDFs in protected mode
File > Preferences > General > Check 'Open cross-domain PDF files in Protected Mode'
🧯 If You Can't Patch
- Use alternative PDF readers for untrusted documents
- Implement application whitelisting to block Foxit execution
🔍 How to Verify
Check if Vulnerable:
Check Foxit version: Help > About Foxit Reader. If version is 11.0.0.49893 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Foxit Reader" get versionVerify Fix Applied:
Verify version is 11.0.1.49944 or later in Help > About Foxit Reader.📡 Detection & Monitoring
Log Indicators:
- Foxit Reader crash logs with exception codes
- Unexpected child processes spawned from Foxit
Network Indicators:
- Outbound connections from Foxit process to unknown IPs
- DNS requests for suspicious domains
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR event_id:1001) OR parent_process:"FoxitReader.exe"