CVE-2023-32664
📋 TL;DR
A type confusion vulnerability in Foxit Reader's JavaScript checkThisBox method allows memory corruption when processing malicious PDF files. This can lead to remote code execution when users open specially crafted PDF documents. All users running vulnerable versions of Foxit Reader are affected.
💻 Affected Systems
- Foxit Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control of the victim's computer, enabling data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Remote code execution with the privileges of the current user, allowing installation of malware, credential theft, and persistence mechanisms.
If Mitigated
Limited impact if PDF files are opened in sandboxed environments or with restricted user privileges, though some data exfiltration may still occur.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious PDF). Technical details and proof-of-concept are publicly available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.3.15356 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: No
Instructions:
1. Open Foxit Reader
2. Go to Help > Check for Updates
3. Follow prompts to install latest version
4. Alternatively, download and install from Foxit website
🔧 Temporary Workarounds
Disable JavaScript in Foxit Reader
allPrevents JavaScript execution in PDF files, blocking the attack vector
Open Foxit Reader > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
allOpen PDFs in restricted mode that prevents script execution
Open Foxit Reader > File > Preferences > General > Check 'Open documents in Protected View'
🧯 If You Can't Patch
- Use alternative PDF readers that are not vulnerable
- Block PDF files from untrusted sources at email gateways and web proxies
🔍 How to Verify
Check if Vulnerable:
Check Foxit Reader version in Help > About. If version is 12.1.2.15332 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Foxit Reader" get versionVerify Fix Applied:
Verify version is 12.1.3.15356 or later in Help > About. Test opening known safe PDFs with JavaScript to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Foxit Reader crash logs with memory access violations
- Unexpected child processes spawned from Foxit Reader
- Network connections from Foxit Reader to suspicious IPs
Network Indicators:
- Outbound connections from Foxit Reader to command-and-control servers
- DNS requests for malicious domains following PDF opening
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR parent_process_name:"FoxitReader.exe")