CVE-2018-9958
HIGHFoxit Reader and PhantomPDF < 9.0.1.1049 - Remote Code Execution via Text Annotation Point Attribute
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2018-9958.
PoCs published by Metasploit, mr_me, CrossWire, including Metasploit module exploits/windows/fileformat/foxit_reader_uaf.
AI-analyzed exploit summary This Metasploit module exploits a Use-After-Free (UAF) vulnerability in Foxit PDF Reader v9.0.1.1049, combining it with an uninitialized pointer issue to leak memory addresses and execute a ROP chain for arbitrary code execution.
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Text Annotations. When setting the point attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5620.
Exploits (5)
This Metasploit module exploits a Use-After-Free (UAF) vulnerability in Foxit PDF Reader v9.0.1.1049, combining it with an uninitialized pointer issue to leak memory addresses and execute a ROP chain for arbitrary code execution.
This exploit leverages CVE-2018-9958 and CVE-2018-9948 to achieve remote code execution in Foxit Reader 9.0.1.1049 via a use-after-free vulnerability and information disclosure. It uses heap manipulation and ROP chains to execute arbitrary code (e.g., calc.exe).
This exploit leverages a use-after-free vulnerability in Foxit Reader 9.0.1.1049 to achieve arbitrary code execution via a crafted PDF file. It employs heap manipulation and ROP chains to execute a specified binary path.
This Metasploit module exploits a Use-After-Free (UAF) vulnerability in Foxit PDF Reader v9.0.1.1049, combining it with an uninitialized pointer issue to leak memory addresses and execute a ROP chain for remote code execution.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H