CVE-2025-66519
📋 TL;DR
A stored XSS vulnerability in Foxit PDF Online's Layer Import functionality allows attackers to inject malicious scripts into the 'Create new Layer' field. When users access the Layers panel, the script executes in their browser context. This affects all users of pdfonline.foxit.com who import layers.
💻 Affected Systems
- Foxit PDF Online
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or install malware through drive-by downloads.
Likely Case
Session hijacking, credential theft, or defacement of the PDF interface through injected content.
If Mitigated
Limited to UI manipulation within the PDF editor interface without access to server-side systems.
🎯 Exploit Status
Requires user interaction (accessing Layers panel) but payload injection is straightforward through layer import.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Foxit security bulletins for specific version
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: No
Instructions:
1. Visit Foxit security bulletins page. 2. Identify patch for CVE-2025-66519. 3. Apply server-side update to pdfonline.foxit.com. 4. No client-side action required.
🔧 Temporary Workarounds
Disable Layer Import
allTemporarily disable the Layer Import functionality in Foxit PDF Online
Content Security Policy
allImplement strict CSP headers to block inline script execution
Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Implement WAF rules to detect and block XSS payloads in layer import requests
- Educate users to avoid accessing Layers panel with untrusted PDFs
🔍 How to Verify
Check if Vulnerable:
Test by importing a layer with payload: <script>alert('XSS')</script> in layer name field and check if alert triggers when accessing Layers panelCheck Version:
Check Foxit security bulletins for patched version informationVerify Fix Applied:
Repeat vulnerability test; successful fix should sanitize input and prevent script execution📡 Detection & Monitoring
Log Indicators:
- Unusual layer names containing script tags or JavaScript patterns
- Multiple failed layer import attempts with special characters
Network Indicators:
- HTTP requests with script tags in POST data to layer import endpoints
SIEM Query:
source="web_logs" AND (uri_path="/layer/import" OR uri_path="/api/layer") AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:")