Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege

2015-03-1400:00:00

Aljaz Ceru

zeroscience.mk

348

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.1%

JSON

Title: Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege
Advisory ID: ZSL-2015-5235
Type: Local
Impact: Privilege Escalation
Risk: (2/5)
Release Date: 14.03.2015

Summary

Foxit Reader is a small, lightning fast, and feature rich PDF viewer which allows you to create (free PDF creation), open, view, sign, and print any PDF file.

Description

The application suffers from an unquoted search path issue impacting the service ‘FoxitCloudUpdateService’ for Windows deployed as part of Foxit Reader. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.

Vendor

Foxit Software Incorporated - <http://www.foxitsoftware.com>

Affected Version

7.0.6.1126 and 6.1

Tested On

Microsoft Windows 7 Ultimate SP1 (EN)

Vendor Status

[17.02.2015] Vulnerability discovered.
[21.02.2015] Foxit Security Response Team confirmed the issue.
[03.03.2015] Foxit fixed the issue.
[09.03.2015] Foxit released fixed version of Foxit Reader 7.1.
[14.03.2015] Coordinated public security advisory released.

PoC

foxitreader_eop.txt

Credits

Vulnerability discovered by Aljaz Ceru - <[email protected]>

References

[1] <http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25>
[2] <http://cxsecurity.com/issue/WLB-2015030094>
[3] <http://www.scip.ch/en/?vuldb.73934>
[4] <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2789>
[5] <https://vulners.com/cve/CVE-2015-2789>
[6] <http://securitytracker.com/id/1031879>
[7] <https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101462>
[8] <http://www.exploit-db.com/exploits/36390/>
[9] <http://packetstormsecurity.com/files/130840>
[10] <http://osvdb.org/show/osvdb/119301>
[11] <http://www.securityfocus.com/bid/73432>
[12] <https://www.vulnerabilitycenter.com/#!vul=49338>

Changelog

[14.03.2015] - Initial release
[15.03.2015] - Added reference [2], [3], [4], [5], [6] and [7]
[16.03.2015] - Added reference [8]
[17.03.2015] - Added reference [9]
[18.03.2015] - Added reference [10]
[10.03.2016] - Added reference [11] and [12]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege


Vendor: Foxit Software Incorporated
Product web page: http://www.foxitsoftware.com
Affected version: 7.0.6.1126 and 6.1

Summary: Foxit Reader is a small, lightning fast, and feature rich PDF
viewer which allows you to create (free PDF creation), open, view, sign,
and print any PDF file.

Desc: The application suffers from an unquoted search path issue impacting
the service 'FoxitCloudUpdateService' for Windows deployed as part of Foxit
Reader. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A
successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Aljaz Ceru
                            [email protected]


Advisory ID: ZSL-2015-5235
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php

Vendor: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25


17.02.2015

--


C:\Users\user&gt;sc qc FoxitCloudUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitCloudUpdateService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Foxit Cloud Safe Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user&gt;
</p></body></html>