Quick answers
- Is CVE-2024-4367 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-4367 being exploited in the wild.
- How severe is CVE-2024-4367?
- High severity, with a CVSS score of 8.8, published 14 May 2024.
- Which products and versions are affected?
- Mozilla Firefox < 126; Mozilla Firefox ESR < 115.11; Mozilla PDF.js < 4.2.67; Mozilla Thunderbird < 115.11; and 2 more.
- Is there a fix for CVE-2024-4367?
- Yes. pdfjs-dist (npm): upgrade to 4.2.67 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-4367 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-4367?
- Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla PDF.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pdfjs-dist (npm): upgrade to 4.2.67 or later
npm install pdfjs-dist@4.2.67
Technical details
A vulnerability in Mozilla PDF.js (specifically the pdfjs-dist npm package) allows for arbitrary JavaScript execution in the context of the hosting domain. The issue stems from the library's use of 'eval' when processing PDF content, which can be abused by a specially crafted PDF file to execute attacker-controlled scripts. This occurs when the 'isEvalSupported' configuration option is set to true, which is the default behavior. An attacker can achieve full Cross-Site Scripting (XSS) by enticing a user to open a malicious PDF. The vulnerability is patched in version 4.2.67 by removing the reliance on 'eval'.
Affected products
- Mozilla pdfjs-dist <= 4.1.392
Identifiers
- CVE-2024-4367
- GHSA-wgrm-67xf-hhpq
Timeline
- 2024-05-06: disclosed
- 2024-05-07: advisory: GitHub Advisory published
- 2024-05-14: patched: NVD publication and patch availability confirmed