EIP-2018-0046

The vulnerability exists within the JavaScript PDF API exposed by Foxit PhantomPDF. The extractPages method of the Document object does not properly validate the export path argument, allowing arbitrary files to be written under the context of the user running PhantomPDF. An attacker can create a specially crafted PDF file that will abuse this vulnerability to achieve remote code execution.

Vulnerability Identifiers

• Exodus Intelligence: EIP-2018-0046
• MITRE CVE: Pending

Vulnerability Metrics

• CVSS Score: 7.5

Vendor References

• https://www.foxit.com/support/security-bulletins.html

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendors: February 24th, 2021
• Disclosed to public: July 27th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.