CVE-2021-38572
📋 TL;DR
This vulnerability in Foxit Reader and PhantomPDF allows attackers to write arbitrary files due to insufficient validation of the extractPages pathname. Attackers can exploit this to potentially execute arbitrary code or overwrite critical system files. All users of affected Foxit software versions are at risk.
💻 Affected Systems
- Foxit Reader
- Foxit PhantomPDF
📦 What is this software?
Foxit Reader by Foxitsoftware
Phantompdf by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
File system corruption, data loss, or privilege escalation through malicious file writes
If Mitigated
Limited impact with proper application sandboxing and file system permissions
🎯 Exploit Status
Exploitation requires user interaction to open a malicious PDF, but the technical complexity is minimal
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.1.4 and later
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.php
Restart Required: Yes
Instructions:
1. Open Foxit Reader/PhantomPDF 2. Go to Help > Check for Updates 3. Follow prompts to install version 10.1.4 or later 4. Restart the application
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents JavaScript-based exploitation vectors
File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Application Sandboxing
allRestrict Foxit's file system access using OS-level controls
🧯 If You Can't Patch
- Block Foxit Reader at network perimeter for untrusted PDF sources
- Implement application whitelisting to prevent unauthorized Foxit execution
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Foxit Reader/PhantomPDF and verify version is below 10.1.4Check Version:
On Windows: wmic product where name='Foxit Reader' get versionVerify Fix Applied:
Confirm version is 10.1.4 or higher in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations from Foxit process
- Multiple extractPages operations in short time
Network Indicators:
- PDF downloads followed by suspicious file writes
- External connections after PDF processing
SIEM Query:
process_name='FoxitReader.exe' AND file_write_operation AND target_path NOT CONTAINS 'Temp'