CVE-2021-38574
📋 TL;DR
This vulnerability allows SQL injection attacks in Foxit Reader and PhantomPDF through crafted data appended to strings. Attackers can execute arbitrary SQL commands, potentially compromising data integrity and confidentiality. All users of affected versions are at risk.
💻 Affected Systems
- Foxit Reader
- Foxit PhantomPDF
📦 What is this software?
Foxit Reader by Foxitsoftware
Phantompdf by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via SQL injection leading to data exfiltration, privilege escalation, or remote code execution.
Likely Case
Data manipulation or extraction from SQL databases used by Foxit applications, potentially exposing sensitive document information.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts may still cause denial of service.
🎯 Exploit Status
Exploitation requires user to open a malicious PDF document. SQL injection payloads can be embedded in document data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.1.4 and later
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.php
Restart Required: Yes
Instructions:
1. Download Foxit Reader/PhantomPDF 10.1.4 or later from official website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents JavaScript-based exploitation vectors that might deliver SQL injection payloads
Open Foxit > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use alternative PDF reader
allTemporarily switch to non-vulnerable PDF software until patching
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only
- Implement application whitelisting to block Foxit Reader/PhantomPDF execution
🔍 How to Verify
Check if Vulnerable:
Open Foxit Reader/PhantomPDF > Help > About. Check if version is below 10.1.4.Check Version:
On Windows: wmic product where name="Foxit Reader" get versionVerify Fix Applied:
Confirm version is 10.1.4 or higher in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries from Foxit processes
- Multiple failed SQL connection attempts
- Large data transfers from Foxit to external IPs
Network Indicators:
- Outbound SQL connections from user workstations
- Unexpected database traffic patterns
SIEM Query:
process_name="FoxitReader.exe" AND (event_id=4688 OR destination_port=1433 OR destination_port=3306)