Foxit PDF Editor SMB Authentication Hash Leak via Malicious PDF

Executive Summary

This vulnerability in Foxit PDF Editor/Reader allows specially crafted PDF files to bypass security prompts and trigger external SMB authentication. This can lead to the leakage of the user's credential hash without their knowledge.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Foxit PDF Editor/Reader leaking credential hashes via SMB authentication without prompts. To detect it, monitor network traffic for unexpected SMB authentication attempts originating from Foxit processes. Check for connections to unknown SMB servers or unusual PDF file interactions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal your hashed credentials, which might be cracked offline to gain access to your accounts. It could also allow unauthorized access to sensitive data if credentials are compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Foxit PDF Editor/Reader to the latest patched version. Disable SMBv1 if enabled, as it is often exploited in such attacks. Restrict outbound SMB connections in firewall rules to prevent unauthorized credential hash leaks. Avoid opening PDFs from untrusted sources.

Useful 0 Not Useful 0