full-disclosure

Open Source and information security mailing list archives

Message-ID: <CAN1eSku1JNGixLWrSUjmc0bozxHaURj0eOe=kVQ8Rfsd2KSN7A@mail.gmail.com>
Date: Sat, 29 Jan 2022 17:58:13 +0800
From: houjingyi <houjingyi647@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] foxit reader Arbitrary File Write

Last year I did some research on JavaScript API used in PDF reader. I found
that if you provide a path to submitForm then this path will be created by
Foxit PDF reader when opening the PDF, this is an *Arbitrary File Write*.

Unfortunately I did not find a way to control the content of the
file.....If you can control the content of the file then you can get *100%
stable RCE*!

This issue was fixed in Foxit PhantomPDF 10.1.5(
https://www.foxit.com/support/security-bulletins.html).

Addressed a potential issue where the application could be exposed to
Arbitrary File Write vulnerability when executing the *submitForm* function.
Attackers could exploit this vulnerability to create arbitrary files in the
local system and inject the uncontrolled contents.

Hou JingYi (@hjy79425575)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives