Executive brief
PDF.js is a browser-based PDF viewer used to display and interact with PDF documents. A malicious PDF can inject malicious JavaScript code through unsanitized PostScript calculator functions, which then executes with the full permissions of the PDF viewer, potentially allowing attackers to steal data, modify documents, or compromise user systems.
Technical details
The vulnerability exists in PDF.js's handling of PostScript calculator functions within PDF documents. The PDFFunctionFactory component fails to properly sanitize or restrict the execution of PostScript code in crafted PDF files, allowing arbitrary JavaScript injection. An attacker can craft a malicious PDF that exploits this weakness; when opened in an affected version of PDF.js, the injected JavaScript executes in the worker context with full viewer permissions. The attack requires user interaction (opening the PDF) but no authentication. The fix involved removing the vulnerable createFromIR function from PDFFunctionFactory, which was merged in April 2018. Affected versions include Firefox ESR <52.8, Firefox <60, and PDF.js <2.0.550 (or <1.10.100 for earlier branches).
Affected products
- Mozilla Firefox < 60
- Mozilla Firefox ESR < 52.8
- Mozilla PDF.js < 1.10.100 or >= 2.0.0 and < 2.0.550
Timeline
- 2018-05: disclosed: Vulnerability disclosed
- 2018-04-12: patched: Fix merged in pdf.js repository (PR #9659)
- 2022-05-14: advisory: GHSA advisory published