CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js

Overview

CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting (XSS) attacks. This affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Usages

Node in /app

npm install

npm start

PoC

• python3 poc.py <payload>
• Example: python3 poc.py "alert(1)"

Demo Videos

• Demo 1 (Firefox)
• Demo 2 (pdfjs-dist)

Mitigation

• Update PDF.js to a version higher than 4.1.392.
• Ensure your Firefox, Firefox ESR, or Thunderbird is up-to-date with the latest security patches.

Detailed Analysis

For a comprehensive analysis of CVE-2024-4367, read here.

PoC references

• https://github.com/LOURC0D3/CVE-2024-4367-PoC
• https://github.com/s4vvysec/CVE-2024-4367-POC