CVE-2023-35985
📋 TL;DR
This vulnerability in Foxit Reader allows attackers to create arbitrary files on a victim's system through a malicious PDF file or website. When exploited, it can lead to arbitrary code execution. Users of Foxit Reader 12.1.3.15356 who open untrusted PDFs or visit malicious websites with the browser plugin enabled are affected.
💻 Affected Systems
- Foxit Reader
📦 What is this software?
Foxit Reader by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation, data exfiltration, or system disruption through file manipulation.
If Mitigated
Limited impact if proper application sandboxing, file system permissions, and user awareness prevent successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction (opening file or visiting malicious site).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.4 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Download latest Foxit Reader from official website. 2. Run installer. 3. Restart system. 4. Verify version is 12.1.4 or higher.
🔧 Temporary Workarounds
Disable Browser Plugin
allPrevents web-based exploitation by disabling Foxit Reader browser integration.
In Foxit Reader: Edit > Preferences > General > uncheck 'Enable browser plugin'
Restrict File Creation
windowsApply file system permissions to limit where Foxit Reader can create files.
Windows: icacls "C:\Program Files\Foxit Software\Foxit Reader" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Use alternative PDF readers like Adobe Acrobat Reader or browser-based viewers.
- Implement application whitelisting to block Foxit Reader execution.
🔍 How to Verify
Check if Vulnerable:
Check Foxit Reader version in Help > About. If version is 12.1.3.15356, system is vulnerable.Check Version:
Windows: wmic product where name="Foxit Reader" get version
Linux: foxitreader --version
macOS: /Applications/Foxit\ Reader.app/Contents/MacOS/FoxitReader --versionVerify Fix Applied:
Verify version is 12.1.4 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Foxit Reader process creating files in unusual locations
- Suspicious file creation events in system logs
Network Indicators:
- Unexpected outbound connections from Foxit Reader process
SIEM Query:
process_name:"FoxitReader.exe" AND file_create_path:("*.exe" OR "*.dll" OR "*.bat")