PT-2023-8582 · Foxit · Foxit Reader
Kamlapati Choubey
·
Publicado
2023-11-22
·
Atualizado
2024-10-07
·
CVE-2023-35985
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Foxit Reader version 12.1.3.15356
Description
The issue is related to the exportDataObject API in Foxit Reader, which fails to properly validate a dangerous extension, leading to an arbitrary file creation vulnerability. This can allow an attacker to create files at arbitrary locations, potentially resulting in arbitrary code execution. The exploitation can occur if a user opens a specially crafted malicious file or visits a malicious site with the browser plugin extension enabled.
Recommendations
For Foxit Reader version 12.1.3.15356, consider disabling the exportDataObject API function until a patch is available to prevent potential exploitation. Restrict access to the Javascript exportDataObject API to minimize the risk of arbitrary file creation. Avoid opening suspicious files or visiting untrusted sites with the browser plugin extension enabled until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Foxit Reader