Inside CVE-2024-4367: Arbitrary JavaScript Execution via PDF.js Context PDF.js as the name suggests is a javascript open source library. This library is primarily used for parsing and rendering PDFs …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

CVE-2024-4367 is a high-severity (CVSS 8.8) vulnerability in PDF.js versions prior to 4.2.67 that allows arbitrary JavaScript execution. The flaw stems from the FontMatrix array in PDF font definitions accepting non-numeric values without validation. These values are directly embedded into dynamically generated JavaScript via the getPathGenerator() function, enabling injection attacks. An attacker can craft a malicious PDF with a specially formed FontMatrix payload to execute arbitrary JS when the PDF is rendered, enabling session hijacking, data exfiltration, and CSRF-style attacks. Mitigations include upgrading to 4.2.67+, setting isEvalSupported to false, validating FontMatrix values as numeric, and sandboxing PDF rendering in iframes.