EXECUTIVE SUMMARY
A critical vulnerability, CVE-2024-4367, has been identified in PDF.js, a popular JavaScript-based PDF viewer integrated into Firefox and various web and Electron-based applications. This flaw allows attackers to execute arbitrary JavaScript code by manipulating the font rendering code when a malicious PDF file is opened. The issue arises from pre-computing a path generator function for every glyph using a JavaScript Function object, where attackers can control the commands inserted into the Function body. The vulnerability can be triggered by altering the fontMatrix array within the PDF metadata, allowing for the execution of arbitrary code. To mitigate this, ensure all dependent libraries are also updated, and consider disabling the eval support in PDF.js settings. Additionally, implementing a strict content-security policy that disables the use of eval and the Function constructor can provide further protection against exploitation.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
A critical vulnerability, CVE-2024-4367, has been identified in PDF.js, a popular JavaScript-based PDF viewer integrated into Firefox and various web and Electron-based applications. This flaw allows attackers to execute arbitrary JavaScript code by manipulating the font rendering code when a malicious PDF file is opened. The issue arises from pre-computing a path generator function for every glyph using a JavaScript Function object, where attackers can control the commands inserted into the Function body. The vulnerability can be triggered by altering the fontMatrix array within the PDF metadata, allowing for the execution of arbitrary code. To mitigate this, ensure all dependent libraries are also updated, and consider disabling the eval support in PDF.js settings. Additionally, implementing a strict content-security policy that disables the use of eval and the Function constructor can provide further protection against exploitation.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
[/emaillocker]