module

Foxit PDF Reader Pointer Overwrite UAF

Try Surface Command
Back to search
Disclosed
2018-04-20
Created
2019-03-19

Description

Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability
in the Text Annotations component and the TypedArray's use
uninitialized pointers.

The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.

This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.

Authors

mr_me
bit from meepwn
saelo
Jacob Robles

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/fileformat/foxit_reader_uaf
    msf exploit(foxit_reader_uaf) > show targets
        ...targets...
    msf exploit(foxit_reader_uaf) > set TARGET < target-id >
    msf exploit(foxit_reader_uaf) > show options
        ...show and set options...
    msf exploit(foxit_reader_uaf) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today