CVE-2024-30355
📋 TL;DR
This vulnerability in Foxit PDF Reader allows remote attackers to execute arbitrary code by tricking users into opening malicious PDF files. The flaw exists in how AcroForms handle Doc objects, enabling out-of-bounds writes that can lead to remote code execution. All users running vulnerable versions of Foxit PDF Reader are affected.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actor gains control of the user's system through crafted PDF files, enabling credential theft, surveillance, or malware installation.
If Mitigated
Limited impact with proper security controls - user may experience application crash but no code execution.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. ZDI has confirmed the vulnerability exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1 or later
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Open Foxit PDF Reader
2. Go to Help > Check for Updates
3. Follow prompts to install version 2024.1 or later
4. Restart the application
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allPrevents JavaScript execution which may be used in exploitation chain
Open Foxit > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
allOpen PDFs in restricted mode to limit potential damage
Open Foxit > File > Preferences > Trust Manager > Check 'Enable Protected View'
🧯 If You Can't Patch
- Use alternative PDF readers temporarily
- Block PDF downloads from untrusted sources via web proxy
🔍 How to Verify
Check if Vulnerable:
Check Foxit version in Help > About. If version is below 2024.1, system is vulnerable.Check Version:
On Windows: wmic product where name="Foxit PDF Reader" get versionVerify Fix Applied:
Verify version is 2024.1 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Application crashes from FoxitPDFReader.exe
- Unusual process spawning from Foxit
- Memory access violation errors
Network Indicators:
- Downloads of PDF files from suspicious sources
- Outbound connections after PDF opening
SIEM Query:
process_name:"FoxitPDFReader.exe" AND (event_id:1000 OR event_id:1001) OR process_parent_name:"FoxitPDFReader.exe"