PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-4367US | high8.8 | Exploit | ||
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ES… | ||||
references
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2024/Aug/30WEB
- https://bugzilla.mozilla.org/show_bug.cgi?id=1893645WEB
- https://cert-portal.siemens.com/productcert/html/ssa-827383.htmlWEB
- https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-jsWEB
- https://github.com/gogs/gogs/issues/7928WEB
- https://github.com/mozilla/pdf.jsPACKAGE
- https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6WEB
- https://github.com/mozilla/pdf.js/pull/18015WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan