16 Vulnerabilities in Apryse WebViewer and Foxit PDF Cloud Services Enable Account Takeover and Data Theft

Researchers at Novee reported 16 vulnerabilities affecting widely deployed PDF platforms Apryse WebViewer (formerly PDFTron) and Foxit PDF cloud services/SDK components, warning they could be exploited for account hijacking, data theft, and in some cases remote code execution. Reported issue classes include DOM-based, stored, and reflected XSS, server-side request forgery (SSRF), path traversal, and OS command injection; testing indicated attackers could trigger exploitation via crafted documents, messages, or URLs, with elevated risk when these viewers are embedded inside authenticated enterprise applications and trusted domains.

Technical details highlighted that Apryse WebViewer spans multiple trust boundaries (a React-based iframe UI ingesting untrusted inputs such as query strings and postMessage, a JavaScript/WebAssembly document engine, and server-side SDK services), and that insufficient validation across these boundaries enabled exploitation paths. The most severe issue described was a critical OS command injection (CVSS 9.8) in Foxit’s Node.js signature server component, where a POST body parameter was reportedly concatenated into a command execution path. Both Apryse and Foxit stated the findings were responsibly disclosed and addressed via patches, updates, and configuration changes, with additional security hardening performed during remediation.