Executive brief
Mozilla PDF.js, a widely used library for displaying PDF files in web browsers, is vulnerable to a flaw that allows a malicious PDF to execute arbitrary code. If a user opens a specially crafted PDF file, an attacker could run malicious scripts in the user's browser, potentially leading to data theft or unauthorized actions on the hosting website. This affects any website or application that uses the default configuration of this library to render PDFs.
Technical details
A vulnerability in Mozilla PDF.js (specifically the pdfjs-dist npm package) allows for arbitrary JavaScript execution in the context of the hosting domain. The issue stems from the library's use of 'eval' when processing PDF content, which can be abused by a specially crafted PDF file to execute attacker-controlled scripts. This occurs when the 'isEvalSupported' configuration option is set to true, which is the default behavior. An attacker can achieve full Cross-Site Scripting (XSS) by enticing a user to open a malicious PDF. The vulnerability is patched in version 4.2.67 by removing the reliance on 'eval'.
Affected products
- Mozilla pdfjs-dist <= 4.1.392
Timeline
- 2024-05-06: disclosed
- 2024-05-07: advisory: GitHub Advisory published
- 2024-05-14: patched: NVD publication and patch availability confirmed