CVE-2024-30338
📋 TL;DR
This is a use-after-free vulnerability in Foxit PDF Reader's Doc object handling that allows remote attackers to execute arbitrary code when a user opens a malicious PDF file or visits a malicious webpage. Attackers can leverage this to run code with the same privileges as the current user process. All users of affected Foxit PDF Reader versions are at risk.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation, credential theft, or data exfiltration from the compromised system.
If Mitigated
Limited impact due to sandboxing, application hardening, or restricted user privileges preventing full system compromise.
🎯 Exploit Status
User interaction required (opening malicious PDF). The vulnerability was discovered by Zero Day Initiative (ZDI-CAN-22705) and has been publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1.0.23997 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to download and install version 2024.1.0.23997 or newer. 4. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript in Foxit Reader
windowsPrevents JavaScript-based exploitation vectors in PDF files
Open Foxit Reader > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
windowsOpen PDFs in restricted mode to limit potential damage
Open Foxit Reader > File > Preferences > Trust Manager > Check 'Enable Safe Reading Mode'
🧯 If You Can't Patch
- Temporarily switch to alternative PDF readers like Adobe Acrobat Reader or browser-based PDF viewers
- Implement application whitelisting to block execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check Foxit Reader version: Open Foxit Reader > Help > About Foxit Reader. If version is below 2024.1.0.23997, you are vulnerable.Check Version:
wmic product where "name like 'Foxit Reader%'" get versionVerify Fix Applied:
Verify version is 2024.1.0.23997 or higher in Help > About Foxit Reader after update.📡 Detection & Monitoring
Log Indicators:
- Unexpected Foxit Reader crashes
- Suspicious child processes spawned from Foxit Reader
- Unusual network connections from Foxit Reader process
Network Indicators:
- Downloads of PDF files from untrusted sources
- HTTP requests to suspicious domains following PDF opening
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR parent_process_name:"FoxitReader.exe")