CVE-2023-38114
📋 TL;DR
This is a use-after-free vulnerability in Foxit PDF Reader's AcroForm Doc object handling that allows remote attackers to execute arbitrary code when a user opens a malicious PDF file. Attackers can gain control of the current process, potentially leading to full system compromise. All users of affected Foxit PDF Reader versions are at risk.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, data theft, ransomware deployment, and lateral movement within the network.
Likely Case
Malicious code execution in the context of the current user, potentially leading to credential theft, data exfiltration, or installation of persistent malware.
If Mitigated
Limited impact if PDF reader runs in sandboxed environment with restricted permissions, though sandbox escape may still be possible.
🎯 Exploit Status
Exploitation requires crafting a malicious PDF file but no authentication is needed. User must open the file, making social engineering a key component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.3.15356 and later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to download and install version 12.1.3.15356 or later. 4. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript in Foxit PDF Reader
windowsDisabling JavaScript prevents exploitation of many PDF vulnerabilities including this one.
Open Foxit PDF Reader > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
windowsEnable Protected View to open PDFs in a restricted mode that prevents code execution.
Open Foxit PDF Reader > File > Preferences > Trust Manager > Check 'Enable Safe Reading Mode'
🧯 If You Can't Patch
- Block PDF files from untrusted sources at email gateways and web proxies
- Use application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Open Foxit PDF Reader, go to Help > About Foxit Reader and check if version is below 12.1.3.15356Check Version:
wmic product where "name like 'Foxit Reader%'" get versionVerify Fix Applied:
Verify version is 12.1.3.15356 or higher in Help > About Foxit Reader📡 Detection & Monitoring
Log Indicators:
- Process creation from Foxit Reader with unusual command lines
- Crash reports from Foxit Reader
- Unusual network connections originating from Foxit Reader process
Network Indicators:
- Outbound connections from Foxit Reader to suspicious IPs
- DNS requests for known malicious domains from PDF reader process
SIEM Query:
process_name:"FoxitReader.exe" AND (process_cmdline:*powershell* OR process_cmdline:*cmd* OR process_cmdline:*wscript*)