CVE-2023-35985 Overview
An arbitrary file creation vulnerability exists in the JavaScript exportDataObject API of Foxit Reader 12.1.3.15356. The vulnerability stems from a failure to properly validate dangerous file extensions, allowing attackers to create files at arbitrary locations on the target system. This can lead to arbitrary code execution when a user opens a specially crafted malicious PDF file or visits a malicious website with the Foxit Reader browser plugin enabled.
Critical Impact
Successful exploitation allows attackers to create arbitrary files on the system, potentially leading to remote code execution through malicious PDF documents or compromised websites.
Affected Products
- Foxit Reader 12.1.3.15356
- Foxit Reader browser plugin extension (when enabled)
Discovery Timeline
- 2023-11-27 - CVE CVE-2023-35985 published to NVD
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2023-35985
Vulnerability Analysis
This vulnerability is classified under CWE-73 (External Control of File Name or Path) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). The exportDataObject JavaScript API in Foxit Reader fails to implement proper validation of file extensions when processing embedded data objects within PDF documents. This allows an attacker to specify dangerous file extensions that bypass security restrictions, enabling the creation of executable files or other malicious content at arbitrary filesystem locations.
The attack requires user interaction—either opening a malicious PDF document directly or visiting a specially crafted website while the Foxit Reader browser plugin is active. Once triggered, the vulnerability allows the attacker to write files outside of intended directories, which can be leveraged for code execution by placing malicious executables or scripts in startup folders, system directories, or other sensitive locations.
Root Cause
The root cause of CVE-2023-35985 lies in improper input validation within the exportDataObject JavaScript API implementation. The API fails to adequately check whether the specified file extension belongs to a list of dangerous or executable file types before performing the file creation operation. This lack of extension validation enables attackers to bypass security controls that would otherwise prevent the creation of potentially harmful files.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability through two primary methods:
Malicious PDF Document: The attacker crafts a PDF file containing embedded JavaScript that calls the exportDataObject API with a dangerous file extension. When a victim opens this PDF in Foxit Reader, the malicious code executes and creates files at attacker-specified locations.
Malicious Website: If the victim has the Foxit Reader browser plugin enabled, the attacker can host a malicious PDF on a website. When the victim visits the site, the browser plugin processes the PDF, triggering the vulnerability without explicit file download.
The vulnerability mechanism involves the JavaScript exportDataObject function being called with parameters that specify an output path containing a dangerous extension (such as .exe, .bat, .cmd, or .hta). Due to insufficient validation, Foxit Reader processes this request and creates the file at the specified location, potentially containing attacker-controlled content extracted from the PDF's embedded data objects.
For detailed technical analysis, see the Talos Intelligence Vulnerability Report.
Detection Methods for CVE-2023-35985
Indicators of Compromise
- Unexpected file creation events in system directories, user startup folders, or temporary directories originating from Foxit Reader processes
- PDF files containing suspicious JavaScript code referencing exportDataObject with executable file extensions
- Foxit Reader (FoxitPDFReader.exe) spawning unexpected child processes or writing to unusual filesystem locations
- Browser plugin activity creating files outside of expected download directories
Detection Strategies
- Monitor file creation events from Foxit Reader processes, particularly those targeting startup folders, %APPDATA%, %TEMP%, or system directories
- Implement endpoint detection rules to flag exportDataObject JavaScript calls within PDF documents that specify dangerous file extensions
- Deploy PDF scanning solutions to inspect incoming documents for suspicious embedded JavaScript payloads
- Enable application whitelisting to prevent execution of files created in unexpected locations
Monitoring Recommendations
- Configure SIEM rules to alert on file creation events by FoxitPDFReader.exe or FoxitReader.exe outside of normal working directories
- Implement behavioral analysis for PDF reader applications to detect anomalous file system activity
- Monitor for process execution chains where Foxit Reader creates and subsequently spawns executable files
- Enable detailed JavaScript logging in PDF readers where available to capture suspicious API calls
How to Mitigate CVE-2023-35985
Immediate Actions Required
- Update Foxit Reader to the latest available version that addresses this vulnerability
- Disable the Foxit Reader browser plugin extension until patching is complete
- Configure Foxit Reader to disable JavaScript execution in PDF documents if not required for business operations
- Educate users about the risks of opening PDF files from untrusted sources
Patch Information
Organizations should consult Foxit's official security advisories for the latest patched version information. The vulnerability affects Foxit Reader version 12.1.3.15356, and users should upgrade to a version that includes the security fix for TALOS-2023-1834. For technical details about the vulnerability, refer to the Talos Intelligence Vulnerability Report.
Workarounds
- Disable JavaScript execution in Foxit Reader by navigating to File → Preferences → JavaScript and unchecking "Enable JavaScript Actions"
- Remove or disable the Foxit Reader browser plugin to prevent web-based exploitation
- Implement strict email filtering and web gateway controls to block potentially malicious PDF attachments
- Deploy application control policies to prevent execution of files created by PDF reader processes in non-standard locations
# Example: Registry modification to disable JavaScript in Foxit Reader (Windows)
# Run in elevated PowerShell
reg add "HKCU\Software\Foxit Software\Foxit Reader 12.0\Preferences\Others" /v bEnableJS /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
