Foxit PDF Reader and Editor Flaw Enables Privilege Escalation

A new privilege escalation vulnerability (CVE-2024-29072, severity 8.2 High) has been discovered in multiple versions of Foxit PDF Reader for Windows. Foxit has fixed the issue and published a security advisory.

Foxit PDF Reader and Editor Flaw

According to reports shared with Cyber Security News, this vulnerability exists due to improper certification validation of the updater executable before execution.

This flaw allows a low-privileged user to trigger the update action and elevate their privileges.

Users can perform the update action in Foxit by navigating to Help → About Foxit PDF Reader → Check For Update.

After this action, FoxitPDFReader.exe writes the FoxitPDFReaderUpdater.exe file to the %APPDATA%\Foxit Software\Continuous\Addon\Foxit PDF Reader folder and runs it under the user context.

Next, FoxitPDFReaderUpdateService.exe calls CryptQueryObject on the FoxitPDFReaderUpdater.exe file to retrieve its certificate information to check if it is signed.

However, FoxitPDFReaderUpdateService.exe only checks for the existence of the certificate without validating it and runs under the SYSTEM context.

A threat actor can exploit this by crafting a malicious file signature using the signtool.exe utility in Visual Studio.

Additionally, another user-controlled self-signed application can call CryptQueryObject, exploiting this vulnerability.

The steps to exploit this vulnerability are as follows:

1. Set an opportunistic lock (oplock) on %APPDATA%\Foxit Software\Continuous\Addon\Foxit PDF Reader\FoxitPDFReaderUpdater.exe.
2. Click “Check For Update.” Due to the oplock on the file, when FoxitPDFReader.exe tries to overwrite FoxitPDFReaderUpdater.exe, it is forced to wait, triggering an oplock callback.
3. During this callback, replace the original FoxitPDFReaderUpdater.exe file with a crafted exploit.
4. FoxitPDFReaderUpdateService.exe calls CryptQueryObject on the modified executable, which passes verification.
5. FoxitPDFReaderUpdateService.exe calls CreateProcessAsUser to execute the malicious executable, escalating privileges to SYSTEM.

Affected versions

This vulnerability affects Foxit Reader versions prior to 2024.2.0.25138. To prevent exploitation, Foxit users are advised to update to the latest version (Foxit PDF Reader 2024.2.2).

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!