Description
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain can be constructed that will execute when Foxit Reader performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64 Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise must have insecure logons enabled for the exploit to work as expected.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/fileformat/foxit/reader_uafmsf undefined(reader_uaf) > show actions ...actions...msf undefined(reader_uaf) > set ACTION < action-name >msf undefined(reader_uaf) > show options ...show and set options...msf undefined(reader_uaf) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub