Tuesday, February 1, 2022

Foxit PhantomPDF Arbitrary File Write

Last year I did some research on JavaScript API used in PDF reader. I found
that if you provide a path to submitForm then this path will be created by
Foxit PDF reader when opening the PDF, this is an *Arbitrary File Write*.

Unfortunately I did not find a way to control the content of the
file.....If you can control the content of the file then you can get *100%
stable RCE*!

This issue was fixed in Foxit PhantomPDF 10.1.5(

Addressed a potential issue where the application could be exposed to
Arbitrary File Write vulnerability when executing the *submitForm* function.
Attackers could exploit this vulnerability to create arbitrary files in the
local system and inject the uncontrolled contents.

Hou JingYi (@hjy79425575)


Copyright © 2021 Vulnerability Database | Cyber Details™

thank you Templateism for the design - You should have written the code a little more complicated - Nothing Encrypted anymore