CVE-2025-66521
📋 TL;DR
A stored XSS vulnerability in Foxit PDF Online's Trusted Certificates feature allows attackers to inject malicious scripts into certificate names. When users view the Trusted Certificates page, the script executes automatically. This affects all users of pdfonline.foxit.com who access the Trusted Certificates feature.
💻 Affected Systems
- Foxit PDF Online (pdfonline.foxit.com)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or install malware through drive-by downloads.
Likely Case
Session hijacking, credential theft, or defacement of the Trusted Certificates interface.
If Mitigated
Limited impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Requires authentication to access Trusted Certificates feature for payload injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: No
Instructions:
1. Visit Foxit security bulletins page
2. Locate CVE-2025-66521 advisory
3. Follow vendor's patching instructions for PDF Online service
🔧 Temporary Workarounds
Disable Trusted Certificates Feature
allTemporarily disable or restrict access to the Trusted Certificates management interface.
Implement WAF Rules
allAdd web application firewall rules to block XSS payloads in certificate name fields.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers
- Monitor and audit Trusted Certificates interface access
🔍 How to Verify
Check if Vulnerable:
Test by attempting to inject a simple XSS payload like <script>alert('test')</script> into a certificate name field.Check Version:
Check web interface footer or about page for version information.Verify Fix Applied:
Verify that injected scripts no longer execute when viewing the Trusted Certificates page.📡 Detection & Monitoring
Log Indicators:
- Unusual certificate name entries containing script tags or JavaScript code
- Multiple failed attempts to access Trusted Certificates feature
Network Indicators:
- HTTP requests containing script tags in POST data to certificate management endpoints
SIEM Query:
source="web_server" AND (uri="/trusted-certificates" OR uri="/certificates") AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:")