CVE-2021-45979
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on macOS systems running vulnerable versions of Foxit PDF Reader and PDF Editor. Attackers can exploit the app.launchURL function in the JavaScript API to run malicious commands. Users of Foxit PDF software on macOS before version 11.1 are affected.
💻 Affected Systems
- Foxit PDF Reader
- Foxit PDF Editor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the macOS system, installing malware, stealing data, and using the system as a pivot point for further attacks.
Likely Case
Remote code execution leading to malware installation, data theft, or ransomware deployment on the affected macOS system.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially containing the exploit to the application context.
🎯 Exploit Status
Public proof-of-concept code exists on GitHub. Exploitation requires user to open a malicious PDF document but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.1 and later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader/Editor. 2. Go to Help > Check for Updates. 3. Follow prompts to update to version 11.1 or later. 4. Restart the application after update completes.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents exploitation by disabling JavaScript execution in PDF documents
1. Open Foxit PDF Reader/Editor
2. Go to Preferences > Security
3. Uncheck 'Enable JavaScript'
4. Click OK and restart application
Use Alternative PDF Viewer
macOSTemporarily use macOS Preview or other PDF viewers until patched
Right-click PDF file > Open With > Choose Preview or other non-Foxit viewer
🧯 If You Can't Patch
- Implement application whitelisting to block execution of unauthorized binaries
- Restrict user privileges to standard user accounts (not admin) to limit exploit impact
🔍 How to Verify
Check if Vulnerable:
Check Foxit version: Open Foxit > Help > About Foxit Reader/Editor. If version is below 11.1, system is vulnerable.Check Version:
On macOS terminal: mdls -name kMDItemVersion /Applications/Foxit\ PDF\ Reader.appVerify Fix Applied:
Verify version is 11.1 or higher in About dialog. Test with known safe PDF containing JavaScript to ensure functionality is maintained.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawning from Foxit processes
- JavaScript execution errors in Foxit logs
- Network connections initiated by Foxit to unexpected destinations
Network Indicators:
- Outbound connections from Foxit process to unknown IPs/domains
- DNS requests for suspicious domains from user workstations
SIEM Query:
process_name:"Foxit" AND (process_command_line:"launchURL" OR parent_process_name:"Foxit")