CVE-2022-24367
📋 TL;DR
This vulnerability in Foxit PDF Reader allows remote attackers to execute arbitrary code by tricking users into opening malicious PDF files or visiting malicious web pages. The flaw exists in how AcroForms handle objects without proper validation, enabling code execution in the current process context. Users of affected Foxit PDF Reader versions are at risk.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Malware installation or data theft through targeted phishing campaigns using malicious PDF attachments.
If Mitigated
Limited impact if proper endpoint protection, application sandboxing, and user training prevent malicious file execution.
🎯 Exploit Status
Exploit requires user interaction but is technically straightforward once malicious file is opened. ZDI published advisory with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.1.1 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest version. 4. Alternatively, download and install latest version from Foxit website. 5. Restart computer after installation.
🔧 Temporary Workarounds
Disable JavaScript in Foxit Reader
allPrevents JavaScript-based exploitation vectors in PDF files
Open Foxit Reader > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
windowsOpen PDFs in sandboxed protected view mode
Open Foxit Reader > File > Preferences > Trust Manager > Check 'Enable Safe Reading Mode'
🧯 If You Can't Patch
- Block PDF files from untrusted sources at email/web gateways
- Use application whitelisting to prevent unauthorized PDF reader execution
🔍 How to Verify
Check if Vulnerable:
Check Foxit Reader version: Open Foxit Reader > Help > About. If version is 11.1.0.52543 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where "name like 'Foxit%'" get versionVerify Fix Applied:
Verify version is 11.1.1 or later in Help > About. Test with known safe PDF files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Foxit Reader crash logs with memory access violations
- Unexpected child processes spawned from Foxit Reader
Network Indicators:
- Outbound connections from Foxit Reader process to suspicious IPs
- DNS requests for known malicious domains after PDF opening
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR parent_process_name:"FoxitReader.exe")