CVE-2025-13941 Foxit PDF Reader/Editor更新服务本地权限提升漏洞

# CVE-2025-13941 Foxit PDF Update Service Privilege Escalation PoC # This PoC demonstrates the permission misconfiguration vulnerability import os import sys import shutil import time def check_vulnerable_version(): """Check if Foxit PDF Reader/Editor is installed and potentially vulnerable""" foxit_paths = [ r"C:\Program Files\Foxit Software\Foxit PDF Reader", r"C:\Program Files (x86)\Foxit Software\Foxit PDF Reader", r"C:\Program Files\Foxit Software\Foxit PDF Editor", r"C:\Program Files (x86)\Foxit Software\Foxit PDF Editor" ] for path in foxit_paths: if os.path.exists(path): print(f"[+] Foxit installation found at: {path}") return True, path return False, None def find_update_service_resources(install_path): """Find resources used by the update service with insecure permissions""" vulnerable_paths = [] update_service_dir = os.path.join(install_path, "resources", "update") plugin_dir = os.path.join(install_path, "plugins") if os.path.exists(update_service_dir): for root, dirs, files in os.walk(update_service_dir): for file in files: file_path = os.path.join(root, file) if file.endswith(('.exe', '.dll')): vulnerable_paths.append(file_path) if os.path.exists(plugin_dir): for root, dirs, files in os.walk(plugin_dir): for file in files: if file.endswith(('.exe', '.dll')): vulnerable_paths.append(os.path.join(root, file)) return vulnerable_paths def check_file_permissions(file_path): """Check if a file has insecure permissions allowing modification""" try: import subprocess result = subprocess.run( ['icacls', file_path], capture_output=True, text=True ) output = result.stdout # Check if Users group has write/modify permissions if 'Users:(F)' in output or 'Users:(M)' in output or 'BUILTIN\Users:(W)' in output: return True return False except Exception as e: print(f"[-] Error checking permissions: {e}") return False def main(): print("=" * 60) print("CVE-2025-13941 Foxit PDF Update Service EoP Checker") print("=" * 60) # Check for Foxit installation is_installed, install_path = check_vulnerable_version() if not is_installed: print("[-] Foxit PDF Reader/Editor not found on this system") return print("[+] Searching for update service resources...") resources = find_update_service_resources(install_path) if not resources: print("[-] No update service resources found") return print(f"[+] Found {len(resources)} potential target files") vulnerable_files = [] for resource in resources: print(f"\n[*] Checking: {resource}") if check_file_permissions(resource): print(f"[+] VULNERABLE: {resource}") print("[+] File has insecure permissions allowing modification by low-privilege users") vulnerable_files.append(resource) else: print(f"[-] Not vulnerable: {resource}") if vulnerable_files: print("\n" + "=" * 60) print(f"[!] System is VULNERABLE to CVE-2025-13941") print(f"[!] Found {len(vulnerable_files)} files with insecure permissions") print("\n[+] Mitigation: Update Foxit PDF Reader/Editor to latest version") else: print("\n" + "=" * 60) print("[+] System appears NOT vulnerable to CVE-2025-13941") if __name__ == "__main__": main()