CVE-2024-30345
📋 TL;DR
This CVE describes a use-after-free vulnerability in Foxit PDF Reader's AcroForm handling that allows remote code execution. Attackers can exploit it by tricking users into opening malicious PDF files, potentially compromising their systems. All users running vulnerable versions of Foxit PDF Reader are affected.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, enabling data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to malware installation, credential theft, or system disruption for the affected user account.
If Mitigated
Limited impact with proper sandboxing and application hardening, potentially resulting only in application crash or denial of service.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. ZDI has confirmed the vulnerability (ZDI-CAN-22742), suggesting exploit development is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Foxit security bulletins for specific patched version
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Visit Foxit security bulletins page
2. Identify the latest patched version for your product
3. Download and install the update
4. Restart the application and system if prompted
🔧 Temporary Workarounds
Disable JavaScript in Foxit PDF Reader
allPrevents exploitation vectors that rely on JavaScript execution in PDFs
Open Foxit PDF Reader > File > Preferences > Security > Uncheck 'Enable JavaScript'
Use alternative PDF viewer
allTemporarily switch to a different PDF reader until Foxit is patched
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only using application control policies
- Implement network segmentation to limit lateral movement if exploitation occurs
🔍 How to Verify
Check if Vulnerable:
Check Foxit PDF Reader version against the affected versions listed in Foxit's security bulletinsCheck Version:
Open Foxit PDF Reader > Help > About Foxit ReaderVerify Fix Applied:
Verify installed version matches or exceeds the patched version specified in Foxit's advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected Foxit PDF Reader crashes
- Suspicious child processes spawned from Foxit
- Unusual network connections originating from Foxit process
Network Indicators:
- Outbound connections to unknown IPs after PDF opening
- DNS requests to suspicious domains from Foxit process
SIEM Query:
Process creation where parent_process_name contains 'FoxitReader.exe' AND (process_name not in ['AcroRd32.exe', 'FoxitPhantomPDF.exe']) OR Network connection where process_name contains 'FoxitReader.exe' AND dest_ip not in trusted_ranges