Exploitation Summary
EIP tracks 2 public exploits for CVE-2011-10030.
PoCs published by Metasploit, bannedit, Chris Evans, including Metasploit module exploits/windows/fileformat/foxit_reader_filewrite.
AI-analyzed exploit summary This exploit leverages an unsafe JavaScript API in Foxit PDF Reader 4.2 to write arbitrary files to the filesystem, achieving remote code execution by dropping a payload in the Startup folder. It uses base64-encoded payloads and a VBS decoder to execute the final executable.
Description
Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.
Exploits (2)
This exploit leverages an unsafe JavaScript API in Foxit PDF Reader 4.2 to write arbitrary files to the filesystem, achieving remote code execution by dropping a payload in the Startup folder. It uses base64-encoded payloads and a VBS decoder to execute the final executable.
This Metasploit module exploits an unsafe JavaScript API in Foxit PDF Reader 4.2, allowing arbitrary file writes via the createDataObject() function. It writes a base64-encoded payload and a decoder script to the Windows Temp directory, achieving remote code execution when an administrative user opens the malicious PDF.
References (6)
Scores
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N