CVE-2024-4367
published 2024-05-14CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects…
PriorityP276high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
72.65%
99.4th percentile
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | firefox | < firefox 126.0-1 (sid) | firefox 126.0-1 (sid) |
| debian | firefox-esr | < firefox 126.0-1 (sid) | firefox 126.0-1 (sid) |
| debian | odoo | < firefox 126.0-1 (sid) | firefox 126.0-1 (sid) |
| debian | thunderbird | < firefox 126.0-1 (sid) | firefox 126.0-1 (sid) |
| github.com | gogs_gogs | >= 0 < 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 |
| gogs.io | gogs | >= 0 < 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 |
| mozilla | firefox | < 115.11.0 | 115.11.0 |
| mozilla | firefox | < 126.0 | 126.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 126.0+build2-0ubuntu0.20.04.1 | 126.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 126.0.1+build1-0ubuntu0.20.04.1 | 126.0.1+build1-0ubuntu0.20.04.1 |
| mozilla | thunderbird | < 115.11.0 | 115.11.0 |
| mozilla | thunderbird | >= 0 < 1:115.11.0-1~deb11u1 | 1:115.11.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:115.11.0-1~deb12u1 | 1:115.11.0-1~deb12u1 |
| mozilla | thunderbird | >= 0 < 1:115.11.0-1 | 1:115.11.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.11.0-1 | 1:115.11.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.11.0+build2-0ubuntu0.20.04.1 | 1:115.11.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:115.11.0+build2-0ubuntu0.22.04.1 | 1:115.11.0+build2-0ubuntu0.22.04.1 |
| nextcloud | nextcloud | < 22.2.10.33 | 22.2.10.33 |
| nextcloud | nextcloud | >= 23 < 23.0.12.29 | 23.0.12.29 |
| nextcloud | nextcloud | >= 24 < 24.0.12.28 | 24.0.12.28 |
| nextcloud | nextcloud | >= 25 < 25.0.13.23 | 25.0.13.23 |
| nextcloud | nextcloud | >= 26 < 26.0.13.20 | 26.0.13.20 |
| nextcloud | nextcloud | >= 27 < 27.1.11.20 | 27.1.11.20 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
/FontMatrix [0.1 0 0 0.1 0 (1\);\n<payload>\n//)]
- →Detect malicious PDF files exploiting CVE-2024-4367 by scanning for a crafted /FontMatrix entry containing JavaScript-like syntax (parentheses-escaped payload) injected into the font matrix array, specifically the pattern `/FontMatrix [0.1 0 0 0.1 0 (1\);` followed by arbitrary code. ↗
- →The exploit abuses a missing type check in PDF.js font handling; monitor web applications using pdfjs-dist for unexpected JavaScript execution originating from PDF rendering contexts (e.g., XSS callbacks with query parameters like `?flag=`). ↗
- →The exploit payload escapes parentheses using backslashes before injection into the FontMatrix field; scan uploaded PDF files for `/FontMatrix` entries containing `\(` and `\)` escaped sequences combined with JavaScript syntax. ↗
- →The crafted malicious PDF uses PDF version header `%PDF-1.4` and embeds the payload within a font object stream; static analysis of uploaded PDFs should flag FontMatrix arrays with non-numeric, code-like content. ↗
- ·The vulnerability is fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11; any deployment of pdfjs-dist older than these versions is vulnerable to arbitrary JS execution via crafted FontMatrix entries. ↗
- ·The root cause is a missing type check when handling fonts in PDF.js; the exploit does not require any special permissions or user interaction beyond opening a crafted PDF in a vulnerable PDF.js context. ↗
- ·Web applications that accept PDF uploads and render them client-side using a vulnerable pdfjs-dist version are directly exploitable; the exploit can be delivered as a standard PDF file passing MIME type checks (`application/pdf`). ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-88cv-g9gq-h6pq: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22
ghsa_unreviewed·2025-12-04·CVSS 8.8
CVE-2025-59788 [HIGH] CWE-749 GHSA-88cv-g9gq-h6pq: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
OSV
Gogs XSS allowed by stored call in PDF renderer
osv·2025-06-26·CVSS 8.8
CVE-2025-47943 [HIGH] Gogs XSS allowed by stored call in PDF renderer
Gogs XSS allowed by stored call in PDF renderer
### Summary
A stored XSS is present in Gogs which allows client-side Javascript code execution.
### Details
Gogs Version:
```
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB
```
Application version: `0.14.0+dev`
Local setup using:
```bash
# Pull image from Docker Hub.
docker pull gogs/gogs
# Create local directory for volume.
sudo mkdir -p /var/gogs
# Use `docker run` for the first time.
docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs
```
The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/.
Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/res
GHSA
Gogs XSS allowed by stored call in PDF renderer
ghsa·2025-06-26·CVSS 8.8
CVE-2025-47943 [HIGH] CWE-79 Gogs XSS allowed by stored call in PDF renderer
Gogs XSS allowed by stored call in PDF renderer
### Summary
A stored XSS is present in Gogs which allows client-side Javascript code execution.
### Details
Gogs Version:
```
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB
```
Application version: `0.14.0+dev`
Local setup using:
```bash
# Pull image from Docker Hub.
docker pull gogs/gogs
# Create local directory for volume.
sudo mkdir -p /var/gogs
# Use `docker run` for the first time.
docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs
```
The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/.
Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/res
GHSA
Arbitrary JavaScript execution due to using outdated libraries
ghsa·2024-06-05·CVSS 8.8
CVE-2024-4367 [HIGH] CWE-79 Arbitrary JavaScript execution due to using outdated libraries
Arbitrary JavaScript execution due to using outdated libraries
### Summary
gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.
### PoC
1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.)
[poc.pdf](https://github.com/user-attachments/files/15516798/poc.pdf)
2. Run the app. In this PoC, I've used the demo for a simple proof.
3. Upload a PDF file containing the script.
4. Check that the script is running.
### Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
###
OSV
Arbitrary JavaScript execution due to using outdated libraries
osv·2024-06-05·CVSS 8.8
CVE-2024-4367 [HIGH] Arbitrary JavaScript execution due to using outdated libraries
Arbitrary JavaScript execution due to using outdated libraries
### Summary
gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.
### PoC
1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.)
[poc.pdf](https://github.com/user-attachments/files/15516798/poc.pdf)
2. Run the app. In this PoC, I've used the demo for a simple proof.
3. Upload a PDF file containing the script.
4. Check that the script is running.
### Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
###
OSV
firefox regressions
osv·2024-05-29·CVSS 8.8
CVE-2024-4767 [HIGH] firefox regressions
firefox regressions
USN-6779-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-4767,
CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773,
CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778)
Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory
when audio input connected with multiple consumers. An attacker could
potentially exploit this issue to cause a denial of
OSV
thunderbird vulnerabilities
osv·2024-05-22·CVSS 8.8
CVE-2024-4767 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768,
CVE-2024-4769, CVE-2024-4777)
Thomas Rinsma discovered that Thunderbird did not properly handle type check
when handling fonts in PDF.js. An attacker could potentially exploit this
issue to execute arbitrary javascript code in PDF.js. (CVE-2024-4367)
Irvan Kurniawan discovered that Thunderbird did not properly handle certain
font styles when saving a page to PDF. An attacker could potentially
exploit this issu
OSV
firefox vulnerabilities
osv·2024-05-21·CVSS 8.8
CVE-2024-4767 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-4767,
CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773,
CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778)
Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory
when audio input connected with multiple consumers. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-4764)
Thomas Rinsma discovered that Firefox did not properly handle type check
when handling fonts in
OSV
CVE-2024-4367: A type check was missing when handling fonts in PDF
osv·2024-05-14·CVSS 8.8
CVE-2024-4367 [HIGH] CVE-2024-4367: A type check was missing when handling fonts in PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
OSV
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
osv·2024-05-07
CVE-2024-4367 [HIGH] PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
### Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
### Patches
The patch removes the use of `eval`:
https://github.com/mozilla/pdf.js/pull/18015
### Workarounds
Set the option `isEvalSupported` to `false`.
### References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
GHSA
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
ghsa·2024-05-07
CVE-2024-4367 [HIGH] CWE-754 PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
### Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
### Patches
The patch removes the use of `eval`:
https://github.com/mozilla/pdf.js/pull/18015
### Workarounds
Set the option `isEvalSupported` to `false`.
### References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Ubuntu
Firefox regressions
vendor_ubuntu·2024-05-29·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-6779-1 caused some minor regressions in Firefox.
USN-6779-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-4767,
CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773,
CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778)
Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory
when audio input connected with multiple consumers.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2024-05-22·CVSS 8.8
CVE-2024-4767 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768,
CVE-2024-4769, CVE-2024-4777)
Thomas Rinsma discovered that Thunderbird did not properly handle type check
when handling fonts in PDF.js. An attacker could potentially exploit this
issue to execute arbitrary javascript code in PDF.js. (CVE-2024-4367)
Irvan Kurniawan discovered that Thunderbird did not properly handle certain
font styles when s
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2024-05-21·CVSS 8.8
CVE-2024-4768 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-4767,
CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773,
CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778)
Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory
when audio input connected with multiple consumers. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-4764)
Thomas Rinsma discovered that Fi
Red Hat
Mozilla: Arbitrary JavaScript execution in PDF.js
vendor_redhat·2024-05-14·CVSS 8.8
CVE-2024-4367 [HIGH] CWE-754 Mozilla: Arbitrary JavaScript execution in PDF.js
Mozilla: Arbitrary JavaScript execution in PDF.js
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Debian
CVE-2024-4367: firefox - A type check was missing when handling fonts in PDF.js, which would allow arbitr...
vendor_debian·2024·CVSS 8.8
CVE-2024-4367 [HIGH] CVE-2024-4367: firefox - A type check was missing when handling fonts in PDF.js, which would allow arbitr...
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Scope: local
sid: resolved (fixed in 126.0-1)
Mozilla
Mozilla Foundation Security Advisory 2024-21: CVE-2024-4367
vendor_mozilla·CVSS 8.8
CVE-2024-4367 [HIGH] Mozilla Foundation Security Advisory 2024-21: CVE-2024-4367
Mozilla Foundation Security Advisory 2024-21
CVE: CVE-2024-4367
Product: Firefox
Impact: moderate
Fixed in: Firefox 126
Mozilla
Mozilla Foundation Security Advisory 2024-22: CVE-2024-4367
vendor_mozilla·CVSS 8.8
CVE-2024-4367 [HIGH] Mozilla Foundation Security Advisory 2024-22: CVE-2024-4367
Mozilla Foundation Security Advisory 2024-22
CVE: CVE-2024-4367
Product: Firefox ESR
Impact: moderate
Fixed in: Firefox ESR 115.11
Mozilla
Mozilla Foundation Security Advisory 2024-23: CVE-2024-4367
vendor_mozilla·CVSS 8.8
CVE-2024-4367 [HIGH] Mozilla Foundation Security Advisory 2024-23: CVE-2024-4367
Mozilla Foundation Security Advisory 2024-23
CVE: CVE-2024-4367
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 115.11
Suricata
ET EXPLOIT Firefox ESR PDF.js Arbitrary Javascript Execution (CVE-2024-4367)
suricata·2025-05-22·CVSS 8.8
CVE-2024-4367 [HIGH] ET EXPLOIT Firefox ESR PDF.js Arbitrary Javascript Execution (CVE-2024-4367)
ET EXPLOIT Firefox ESR PDF.js Arbitrary Javascript Execution (CVE-2024-4367)
Rule: alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Firefox ESR PDF.js Arbitrary Javascript Execution (CVE-2024-4367)"; flow:established,to_client; file.data; content:"|25|PDF|2d|"; startswith; content:"|2f|FontMatrix|20 5d|"; fast_pattern; pcre:"/^[^7d]*?\x3b/R"; reference:url,www.exploit-db.com/exploits/52273; reference:cve,2024-4367; classtype:misc-attack; sid:2062514; rev:1; metadata:affected_product Firefox, attack_target Client_Endpoint, created_at 2025_05_22, cve CVE_2024_4367, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_22; target:dest_ip;)
Bugzilla
CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [fedora-all]
bugzilla·2026-06-22·CVSS 8.8
CVE-2024-4367 [HIGH] CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [fedora-all]
CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [epel-all]
bugzilla·2026-06-22·CVSS 8.8
CVE-2024-4367 [HIGH] CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [epel-all]
CVE-2024-4367 webkitgtk: Arbitrary JavaScript execution in PDF.js [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js
bugzilla·2024-05-14·CVSS 8.8
CVE-2024-4367 [HIGH] CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js
CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4367
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2024:2888 https://access.redhat.com/errata/RHSA-2024:2888
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.0 Extended Update Support
Via RHSA-2024:2884 https://access.redhat.com/errata/RHSA-2024:2884
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.2 Advanced Update Support
Via RHSA-2024:2882 https://access.redha
Bugzilla
Arbitrary Javascript injection in PDF.js through FontMatrix
bugzilla·2024-04-26
Arbitrary Javascript injection in PDF.js through FontMatrix
Arbitrary Javascript injection in PDF.js through FontMatrix
Created attachment 9398837
js_injection_poc.pdf
(Tested with Firefox 124.0b9 on Ubuntu and with PDF.js latest from Git.)
Arbitrary Javascript code can be executed in the PDF.js context (unrelated to the Javascript sandbox) by abusing a lack of type checking in the glyph path compilation process, specifically when a Type 1 font is involved. A prerequisite is that `isEvalSupported` needs to be true (it is by default).
This results in a somewhat universal XSS when a PDF is opened with Firefox (cross-origin restrictions are still in place). An attacker can control the PDF.js window and do things like spy on the user’s activity, trigger downloads using `pdf.js.message` events (even file:// URLs can be “downloaded” in this way) or l
CTF
Upload / README
ctf_writeups·2024·CVSS 8.8
CVE-2024-4367 [HIGH] Upload / README
# Upload
## Exploring the Intricacies of CVE-2024-4367 in PDF.js Library for XSS Exploits
### Authored by: @S0nG0ku
### Title: Exploiting CVE-2024-4367 in PDF.js Library for XSS Vulnerabilities
#### Introduction:
CVE-2024-4367 presents a critical vulnerability within the esteemed PDF.js library, widely embraced for its adeptness in rendering PDF files in web browsers. This particular exploit enables adversaries to inject and execute arbitrary JavaScript code within a user's browser context, catalyzing a perilous Cross-Site Scripting (XSS) scenario.
#### In-Depth Analysis:
- Delving into the Application's PDF File Upload Mechanism:
```javascript
const upload = multer({
storage: storage,
fileFilter: (req, file, cb) => {
if (file.mimetype == "application/pdf") {
cb(null, true);
} else
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645https://lists.debian.org/debian-lts-announce/2024/05/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00012.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/http://seclists.org/fulldisclosure/2024/Aug/30https://bugzilla.mozilla.org/show_bug.cgi?id=1893645https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/https://github.com/gogs/gogs/issues/7928https://github.com/mozilla/pdf.js/releases/tag/v4.2.67https://lists.debian.org/debian-lts-announce/2024/05/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00012.htmlhttps://www.exploit-db.com/exploits/52273https://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/https://cert-portal.siemens.com/productcert/html/ssa-827383.html
2024-05-14
Published