Foxit Webplugins XSS

Foxit Webplugins is a web application that provides plugins for various browsers. This vulnerability exists in the postMessage handler, which fails to validate the message origin and directly assigns externalPath to a script source, allowing an attacker to execute arbitrary JavaScript when a crafted postMessage is received.

Specific version info not stated in the advisory.

Concrete steps:

1. Upgrade to Foxit Webplugins version 2.x or later.
2. Download from: https://www.foxit.com/downloads

Immediate mitigations:
- Restrict network access to your Foxit Webplugins instance (firewall it from the public internet)
- Audit admin account activity for suspicious access patterns
- Monitor for unauthorized token creation

• www.foxit.com