Foxit Products Insecure Direct Object Reference Vulnerability Allowing Unauthorized Access or Modification

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the signing invitation acceptance process of Foxit PDF Reader, Foxit PDF Editor, and Foxit eSign. This vulnerability arises from insufficient authorization validation on user-supplied object identifiers, which could be manipulated to access or modify unauthorized resources. Under certain conditions, this could lead to forged signatures, compromising the integrity and authenticity of documents in the signing process.

Impact

Exploitation of this vulnerability could result in horizontal privilege escalation, allowing an attacker to access or modify resources belonging to another user, potentially leading to unauthorized changes in document signatures.

Remediation

Users can update to the latest versions of Foxit PDF Reader or Foxit PDF Editor. For Foxit PDF Reader, the updated version can be downloaded from the Foxit website or via the application's update feature. For Foxit PDF Editor, the latest version is also available on the Foxit website or through the application's update option. Foxit eSign has been automatically updated to address this vulnerability.