The vulnerability exists within the ConnectedPDF service, implemented by the FoxitPhantomConnectedPDFService.exe binary. The service listens for connections on TCP port 44440 on localhost and fails to sanitize input data before using it to construct SQL queries. This allows arbitrary files to be written under the context of the user running PhantomPDF. An attacker can create a specially crafted PDF file that will abuse this vulnerability to achieve remote code execution. Each message has a Type field, denoting the message type. The vulnerability resides in the processing of message type 1004, the handler of which is characterized by string references such as “DocSearch_Locator_Table”.
- Exodus Intelligence: EIP-2018-0081
- MITRE CVE: Pending
- CVSSv2 Score: 7.5
- Exodus Intelligence
- Disclosed to affected vendors: February 24th, 2021
- Disclosed to public: July 27th, 2021
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at firstname.lastname@example.org.
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.