Arbitrary JavaScript Execution in PDF.js

This repository is a very small proof-of-concept exploit set containing two files: an HTML page and a crafted PDF. The HTML file, CORS.html, contains a simple form that issues a GET request to https://ehis-hsms-openresty-dmzweb-prd.health.pingan.com/runHealth/vitalityGo/equipment/equipmentBind.token when the user clicks Submit. It also calls history.pushState('', '', '/') to mask the visible path after loading. This suggests a web attack vector focused on cross-origin request triggering, likely for CSRF/CORS behavior testing rather than full remote code execution. The second file, poc.pdf, is a malformed/crafted PDF proof of concept. The notable malicious behavior is embedded in the /FontMatrix field of a Type1 font object, where JavaScript-like content attempts to break out of expected parsing and execute alert('document.domain: '+window.document.domain+'\nlocation: '+window.location+'\ncookie: '+window.document.cookie). If interpreted by a vulnerable PDF renderer or browser-integrated PDF engine, this would expose client-side context such as domain, URL, and cookies via an alert box. That makes the PDF a browser/file-based exploit PoC aimed at demonstrating script execution or parser confusion in PDF handling. Repository structure is minimal and purpose-built: one web PoC and one PDF PoC, with no supporting framework, automation, or weaponized payload delivery. There is no evidence of persistence, shell access, downloader behavior, or post-exploitation logic. Overall, this is best classified as a proof-of-concept exploit repository demonstrating client-side web/PDF security issues, with the main actionable observables being the Ping An Health HTTPS endpoint and the embedded JavaScript payload in the PDF.

This repository is a small proof-of-concept lab for CVE-2024-4367 affecting PDF.js. It is not a standalone exploit that generates a malicious PDF; instead, it provides a reproducible vulnerable environment and a web workflow that accepts uploaded PDF files and immediately opens them in a vulnerable PDF.js viewer. The repository contains 5 files: a README with setup instructions, docker-compose.yml to launch a vulnerable container image (vulhub/pdfjs:4.1.392), index.php implementing the upload-and-redirect logic, style.css for presentation, and .gitattributes. The main exploit-relevant logic is in index.php: it creates an upload directory, accepts multipart file uploads, enforces only a superficial .pdf extension check, stores the file under a random name in /upload/, and then issues a 302 redirect to /web/viewer.html?file=../upload/<random>.pdf. That redirect is the key reproduction step because it causes the browser to render the attacker-supplied PDF through the vulnerable PDF.js instance. The attack vector is web/browser-based, and the intended outcome is client-side XSS when a crafted malicious PDF is viewed. No exploit payload is embedded in the repository itself; the operator is expected to supply a malicious PDF separately. Overall, this is a realistic vulnerable lab environment for demonstrating or testing PDF.js XSS, rather than a weaponized exploit framework.

This repository provides a Proof of Concept (PoC) exploit for CVE-2024-4367, a Cross-Site Scripting (XSS) vulnerability. The main exploit is delivered as a crafted PDF file ('CVE-2024-4367-PoC.pdf') that contains embedded JavaScript code. When the PDF is opened in a vulnerable environment (such as a web application or PDF viewer that improperly handles embedded JavaScript), the payload executes and collects a wide range of information from the victim's browser. This includes domain, URL, cookies, local and session storage, user agent, screen and device details, browser plugins, geolocation availability, and more. The information is displayed via a series of alert dialogs, demonstrating the impact of the XSS vulnerability. The repository also includes a README.md with detailed descriptions of the exploit's capabilities and sample output images (referenced but not included in the archive). There are no hardcoded network endpoints or external domains in the payload; the exploit is focused on local browser data exfiltration and demonstration. The structure is simple, with the main exploit in the PDF file, a README, a license, and a sample directory with a text file.

This repository contains a single file: 'Odoo_PDFjs_CVE-2024-4367.pdf', which is a crafted PDF file designed to exploit CVE-2024-4367 in Odoo's PDF.js integration. The exploit leverages a vulnerability in how PDF.js (as used by Odoo) handles font encoding, specifically by injecting JavaScript code (prompt("1337rokudenashi")) into the /FontMatrix field of a font object. When a vulnerable Odoo instance processes this PDF (e.g., when a user previews or opens it in the web interface), the embedded JavaScript is executed in the browser context, demonstrating a cross-site scripting (XSS) attack. The repository does not contain any code files other than the exploit PDF itself, and there are no hardcoded network endpoints or URLs. The exploit serves as a proof-of-concept to demonstrate the vulnerability and does not include weaponized or customizable payloads.

This repository provides a proof-of-concept (POC) exploit for CVE-2024-4367, a vulnerability in Mozilla's PDF.js that allows arbitrary JavaScript execution via a specially crafted PDF file. The main file, CVE-2024-4367.py, is a Python script that generates a malicious PDF by injecting user-supplied JavaScript into the FontMatrix field of a font object within the PDF structure. The script takes two arguments: the output PDF filename and the JavaScript payload to inject. The included mali.pdf is an example of such a malicious PDF, with a payload that triggers an alert dialog. The README provides usage instructions and references to the vulnerability and related resources. The exploit targets applications or services using PDF.js to render PDF files, and the attack vector is a malicious file delivered to the target. No network endpoints or external domains are involved; exploitation is achieved by convincing a user or system to open the crafted PDF in a vulnerable PDF.js environment.

This repository contains four files, all of which are PDF documents or raw PDF data. The files are named 'POC', 'POC.pdf', 'POC_XSS.pdf', and 'POC_XSS_test'. Each file is a crafted PDF designed to demonstrate exploitation of a browser-based PDF viewer via embedded JavaScript in the font encoding or FontMatrix. The payloads include JavaScript code such as alert('document.location'), alert('document.origin'), and alert(document.location.origin), which are typical for XSS proof-of-concept. Notably, 'POC_XSS.pdf' contains a more advanced payload that attempts to exfiltrate the victim's localStorage access token to an external endpoint (https://webhook.site/acfff587-0497-4205-be3c-1d44f3a6c6b8/?c=). The repository serves as a proof-of-concept for exploiting XSS vulnerabilities in PDF viewers that improperly handle embedded JavaScript, demonstrating both alert-based and data exfiltration attacks. No source code is present; all logic is embedded within the PDF structure.

This repository provides a proof-of-concept (POC) exploit for CVE-2024-4367, a vulnerability in Mozilla's PDF.js library that allows arbitrary JavaScript execution via crafted PDF files. The main script, 'pdf-modify.py', is a Python tool that takes a base PDF file containing a 'PLACEHOLDER' string and replaces it with a user-defined JavaScript payload. Several example payloads are provided in the script as commented lines, including ones that exfiltrate cookies or open remote URLs. The default payload in the script sends the victim's cookies to 'https://acme.safesecureproxy.xyz/catch?c='. The exploit does not include a payload delivery mechanism but generates a malicious PDF for use in further attacks. The repository is structured simply, with a license, a README explaining usage, and the main exploit script. No detection or fake code is present; this is a functional POC for the specified CVE.

This repository provides a hands-on proof-of-concept (PoC) for CVE-2024-4367, a vulnerability in Mozilla Firefox's PDF.js component that allows JavaScript execution via a crafted PDF file. The repository includes: - A Python script (firefox.py) that automates downloading specific Firefox Nightly builds (vulnerable and patched), unpacks them, and opens a provided PDF file (poc.pdf) to demonstrate the exploit or its mitigation. - Instructions in the README.md for generating a malicious PDF using an external PoC script (referenced as a submodule) and for testing both vulnerable and patched Firefox versions. - A JavaScript diff file (pdfjs_diff_font_renderer.js) showing the differences between vulnerable and fixed versions of PDF.js's font renderer, aiding in understanding the vulnerability. - Submodules for the PoC generator and both vulnerable and fixed PDF.js source trees. The exploit demonstrates that opening a crafted PDF in a vulnerable Firefox Nightly build results in JavaScript execution (e.g., an alert box), confirming the vulnerability. The repository is structured for educational purposes, allowing users to observe the vulnerability and its remediation.

This repository is a proof-of-concept (PoC) and educational demonstration for CVE-2024-4367, a high-severity vulnerability in Mozilla's PDF.js library. The vulnerability allows arbitrary JavaScript execution via improper type checking in the font handling code, specifically through the /FontMatrix array in embedded fonts. The repository contains several malicious PDF files (e.g., ex1.pdf, ex-gist.pdf, ex-voice.pdf, ex-joke.pdf) that exploit this flaw by embedding JavaScript code or code that fetches and executes remote scripts. The exploit is demonstrated in a web application built with Astro, React, Vue, and Svelte, using vulnerable versions of PDF.js (via react-pdf and pdfjs-dist). The main exploit vector is opening a malicious PDF in a vulnerable PDF.js-based viewer with dynamic code execution enabled, leading to arbitrary JavaScript execution in the browser or Electron context. The repository also includes mitigation advice and a technical report. Notable endpoints include remote scripts hosted on gist.githubusercontent.com and an API endpoint at icanhazdadjoke.com, which are accessed by the malicious PDFs to demonstrate remote code execution and data exfiltration capabilities.

This repository contains two PDF files, 'exploit.pdf' and 'poc.pdf', both of which are weaponized with embedded JavaScript code. The JavaScript is obfuscated within the PDF font metadata and is designed to exploit a target that processes PDFs and allows JavaScript execution. The exploit attempts to fetch a sensitive file ('flag.pdf') from the server (either via a local path or a relative path) and exfiltrate its contents to an attacker-controlled endpoint (either 'https://ha.requestcatcher.com' or 'https://webhook.site'). The structure of the repository is minimal, containing only the two crafted PDF files, each serving as a proof-of-concept for file exfiltration via malicious PDF. No explicit CVE or targeted product is mentioned, but the exploit is likely aimed at web applications or PDF readers that unsafely execute JavaScript in PDFs. The attack vector is browser-based, requiring the target to open the malicious PDF in a vulnerable environment.

This repository provides a proof-of-concept exploit for CVE-2024-4367, targeting a vulnerability in PDF processing. The main file, CVE-2024-4367.py, is a Python script that generates a malicious PDF file (poc.pdf) with a user-supplied payload injected into the PDF's FontMatrix field. The payload can be arbitrary JavaScript or system commands, such as launching the Windows calculator or triggering an alert dialog. The repository also includes two example malicious PDF files: win_calc.pdf (which attempts to execute 'calc' via Node.js child_process) and xss.pdf (which triggers a JavaScript alert). The exploit requires the victim to open the generated PDF with a vulnerable application, at which point the injected code is executed. The structure is straightforward: one Python generator script and two sample payload PDFs. No network endpoints or external domains are involved; the attack vector is a crafted file delivered to the target.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-4367, demonstrating XSS (Cross-Site Scripting) attacks via malicious PDF files. The structure includes: - A Python script (payload/poc.py) that generates malicious PDF files by embedding arbitrary JavaScript payloads in the /FontMatrix of a PDF font object. - Several pre-generated PDF payloads (alert.pdf, calculatrice.pdf, cookies.pdf, keylogger.pdf, localstorage.pdf, redirection.pdf) each containing different JavaScript exploits, such as alert popups, cookie theft, localStorage exfiltration, keylogging, and redirection. - An Electron-based PDF viewer (index.js, html/pdfviewer.html) that loads and renders PDF files. The viewer is intentionally insecure, with nodeIntegration enabled and contextIsolation disabled, making it vulnerable to JavaScript execution and, in the case of Electron, arbitrary command execution (e.g., launching calc.exe). - A Node.js Express server (server.js) that acts as a malicious endpoint, receiving exfiltrated data (cookies, localStorage, keylogger data, etc.) and serving the malicious PDF viewer. - The readme.md provides detailed instructions and explanations for each attack scenario, including code samples for XSS, phishing, DDoS, and desktop command execution. The main exploit capability is to generate and deliver PDF files that, when opened in a vulnerable viewer, execute attacker-controlled JavaScript. This can lead to theft of sensitive data, phishing, DDoS, and, in desktop environments like Electron, full system compromise. The repository is operational, with working payloads and a server to receive exfiltrated data. Multiple fingerprintable endpoints are used for data exfiltration and attack demonstration.

This repository provides a fully operational exploit for CVE-2024-4367, a critical vulnerability in PDF.js that allows arbitrary JavaScript execution via insufficient type checks on the FontMatrix object. The main script, 'cve_2024_4367_exploit_wizard.py', is a Python 3 wizard that automates the attack workflow: 1. It verifies and installs dependencies (PyPDF2 and SET), 2. Creates a malicious PDF by injecting a JavaScript payload into the FontMatrix field of a provided 'template.pdf', 3. Manages a list of campaign targets (e.g., email addresses), 4. Integrates with the Social Engineering Toolkit (SET) to facilitate phishing campaigns for delivering the malicious PDF, 5. Hosts the malicious PDF on a local HTTP server (http://localhost:8080), which also logs any exfiltrated data (such as cookies) sent by the JavaScript payload when the PDF is opened in a vulnerable PDF.js environment. The payload is hardcoded to exfiltrate document cookies to a local endpoint, but the script and README provide guidance for customizing the payload for other actions. The repository is structured with a single Python exploit script and a detailed README that explains setup, usage, and legal considerations. The exploit is intended for educational and authorized penetration testing only.

This repository is a proof-of-concept (POC) project demonstrating exploitation of CVE-2024-4367, a vulnerability in the PDF.js (pdfjs-dist) library. The project is structured as a web application using the Astro framework, with React, Vue, and Svelte components for rendering PDFs via PDF.js. The /public directory contains several crafted PDF files, each designed to exploit the vulnerability in different ways: - 'ex1.pdf' triggers a simple JavaScript alert. - 'CVE-2024-4367-v1.pdf' demonstrates access to window.origin and PDFViewerApplication.url via alert. - 'ex-gist.pdf' and 'ex-voice.pdf' fetch and execute remote JavaScript code from gist.githubusercontent.com using fetch and eval. - 'ex-joke.pdf' fetches a joke from icanhazdadjoke.com and logs it, demonstrating arbitrary fetch capability. The exploit works by embedding JavaScript in the /FontMatrix property of a PDF font object, which is then executed by the vulnerable PDF.js library when the PDF is loaded in the browser. The application allows users to select which PDF to load in each frontend framework, making it easy to test the exploit in different environments. The main exploit capability is browser-based arbitrary JavaScript execution (XSS/RCE) via malicious PDF files. The repository is a clear, educational POC and does not include weaponized or automated exploitation tools.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-4367, a vulnerability in Mozilla's PDF.js library that allows for arbitrary JavaScript execution when a specially crafted PDF file is opened. The exploit is implemented in a single Python script ('cve-2024-4367.py'), which takes a user-supplied JavaScript payload and embeds it into a malicious PDF file ('poc.pdf'). The README.md explains the impact and affected products, specifically highlighting Firefox versions prior to 126 and any applications using PDF.js for PDF rendering. The exploit does not target a network service directly but relies on the victim opening the generated PDF file in a vulnerable environment, making the attack vector local (user-assisted) and browser-based. The repository is structured simply, with a license, a brief README, and the main exploit script. No hardcoded network endpoints or IP addresses are present; the only fingerprintable artifact is the generated malicious PDF file.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-4367, a critical vulnerability in PDF.js that allows arbitrary JavaScript execution (XSS) when a crafted PDF is opened in a vulnerable environment. The repository contains: - A Python script (poc/poc.py) that generates a malicious PDF file (poc.pdf) embedding a user-supplied JavaScript payload in the FontMatrix field of a font object. This PDF, when opened in a vulnerable PDF.js instance (such as in outdated Firefox or Thunderbird), triggers the JavaScript payload. - A Node.js Express application (app/server.js) serving a simple web interface (app/public/index.html) for uploading and viewing PDFs using pdfjs-dist 3.1.81, which is a vulnerable version. This allows for local demonstration and testing of the exploit. - The README.md provides clear usage instructions, affected product versions, mitigation advice, and references to further analysis and related PoCs. The exploit demonstrates the vulnerability by generating a PDF that, when rendered, executes arbitrary JavaScript in the browser context. The attack vector is browser-based, requiring user interaction (opening the malicious PDF). The repository is structured for both automated PDF generation and local demonstration via a web server.

This repository is a proof-of-concept (POC) exploit for CVE-2024-4367, a vulnerability in Mozilla's PDF.js that allows arbitrary JavaScript execution when a specially crafted PDF is opened. The repository contains three files: a README.md with usage instructions and references, a Python script (poc.py) that generates a malicious PDF file embedding attacker-supplied JavaScript, and a sample malicious.pdf. The exploit works by injecting the JavaScript payload into the PDF's FontMatrix field, which is then executed by vulnerable PDF.js instances. The main attack vector is a crafted PDF file, and the primary fingerprintable endpoint is the generated malicious PDF. The exploit is a POC and does not include advanced payloads or automation for delivery; it simply demonstrates the vulnerability by allowing the user to specify arbitrary JavaScript to be executed upon opening the PDF.

This repository provides a proof-of-concept exploit for CVE-2024-4367 and CVE-2024-34342, which are vulnerabilities in PDF.js (used by Firefox, Firefox ESR, and Thunderbird) that allow arbitrary JavaScript execution when a malicious PDF is opened. The repository contains two files: a Python script (CVE-2024-4367.py) and a README.md. The Python script generates a malicious PDF file (poc.pdf) embedding attacker-supplied JavaScript payloads. The README explains the vulnerability, affected products, and provides usage examples for both JavaScript and OS command execution (the latter in Electron-based apps). The exploit requires the victim to open the generated PDF with a vulnerable application. The main attack vector is a crafted file (PDF) that, when opened, triggers the vulnerability. No network endpoints or external IPs/domains are present in the code. The exploit is operational, allowing arbitrary payloads to be embedded and executed in the target context.

This repository contains a proof-of-concept exploit script (PDFernetRemotelo.py) that demonstrates remote code execution by chaining two vulnerabilities: CVE-2024-4367 (PDF exploit) and CVE-2023-38831 (WinRAR exploit). The main script is written in Python and automates the creation of a malicious PDF and a specially crafted RAR archive. The workflow is as follows: 1. The attacker provides their IP and port, which are used to configure a batch script that opens a reverse shell using ncat. 2. The script generates a bait PDF and a batch file, then creates a malicious RAR archive exploiting the WinRAR vulnerability. 3. It also generates a malicious PDF file that, when opened in a vulnerable version of Firefox, triggers the download of the malicious RAR file. 4. The script starts a local HTTP server to host the malicious files and prints a URL (http://<attacker_ip>/poc.pdf) for the attacker to send to the victim. 5. If the victim opens the PDF and extracts/executes the RAR contents, the batch script is run, connecting back to the attacker's machine and granting remote command execution. The repository includes a README.md with background information and usage instructions. The exploit targets Windows systems with specific vulnerable versions of WinRAR and Firefox. The main attack vectors are network (HTTP delivery and reverse shell) and file-based (malicious PDF and RAR).

This repository is a proof-of-concept (POC) project demonstrating exploitation of CVE-2024-4367, a vulnerability in the PDF.js (pdfjs-dist) library. The project is structured as a web application using the Astro framework, with React, Vue, and Svelte components for rendering PDFs via PDF.js. The /public directory contains several PDF files, some of which are crafted to exploit the vulnerability by embedding malicious JavaScript in the /FontMatrix property of a font object within the PDF. When these PDFs are rendered by PDF.js in the browser, the JavaScript is executed in the context of the web page, allowing for actions such as displaying alerts, fetching and executing remote JavaScript code, or exfiltrating data via network requests. The exploit demonstrates both simple payloads (e.g., alert popups) and more advanced payloads (e.g., fetching and evaluating remote code, or fetching data from external APIs). The repository is intended for demonstration and educational purposes, highlighting the impact of the vulnerability and the risks of rendering untrusted PDFs in the browser.