Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-4367

Quick assessment

Affected
Mozilla Firefox
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mozilla Firefox是美国Mozilla基金会的一款开源Web浏览器。 Mozilla Firefox 126 版本之前存在安全漏洞，该漏洞源于处理 PDF.js 中的字体时缺少类型检查，这将允许在 PDF.js 环境中执行任意 JavaScript。

AI Predicted 8.7 Difficulty: Easy EPSS 70.66% · P99

Public Exploits 1

ExploitDB · 1 EDB-52273 [remote]

Affected Version Matrix 3

VendorProduct Version RangeStatus
Mozilla Firefox unspecified< 126 affected
Mozilla Firefox ESR unspecified< 115.11 affected
Mozilla Thunderbird unspecified< 115.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-4367

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Mozilla Firefox 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mozilla Firefox是美国Mozilla基金会的一款开源Web浏览器。 Mozilla Firefox 126 版本之前存在安全漏洞，该漏洞源于处理 PDF.js 中的字体时缺少类型检查，这将允许在 PDF.js 环境中执行任意 JavaScript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mozilla Firefox unspecified ~ 126 -
Mozilla Firefox ESR unspecified ~ 115.11 -
Mozilla Thunderbird unspecified ~ 115.11 -

II. Public POCs for CVE-2024-4367

# POC Description Source Link Shenlong Link
1 CVE-2024-4367 & CVE-2024-34342 Proof of Concept https://github.com/LOURC0D3/CVE-2024-4367-PoC POC Details
2 CVE-2024-4367 arbitrary js execution in pdf js https://github.com/s4vvysec/CVE-2024-4367-POC POC Details
3 YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js https://github.com/spaceraccoon/detect-cve-2024-4367 POC Details
4 CVE-2024-4367 mitigation for Odoo 14.0 https://github.com/avalahEE/pdfjs_disable_eval POC Details
5 This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js (pdfjs-dist) library reported in CVE-2024-4367 https://github.com/clarkio/pdfjs-vuln-demo POC Details
6 PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （<126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Electron 的应用程序，这些应用程序（间接）使用 PDF.js 进行预览功能。 https://github.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed POC Details
7 This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js (pdfjs-dist) library reported in CVE-2024-4367 https://github.com/snyk-labs/pdfjs-vuln-demo POC Details
8 PoC - Prueba de Concepto de CVE-2024-4367 en conjunto al CVE-2023-38831 en un solo Script https://github.com/UnHackerEnCapital/PDFernetRemotelo POC Details
9 CVE-2024-4367复现 https://github.com/Scivous/CVE-2024-4367-npm POC Details
10 None https://github.com/Masamuneee/CVE-2024-4367-Analysis POC Details
11 None https://github.com/pedrochalegre7/CVE-2024-4367-pdf-sample POC Details
12 CVE-2024-4367 is a critical vulnerability (CVSS 9.8) in PDF.js, allowing arbitrary JavaScript code execution due to insufficient type checks on the FontMatrix object within PDF files. https://github.com/exfil0/WEAPONIZING-CVE-2024-4367 POC Details
13 This Proof of Concept (PoC) demonstrates the exploitation of the CVE-2024-4367 vulnerability, which involves Cross-Site Scripting (XSS) attacks. https://github.com/inpentest/CVE-2024-4367-PoC POC Details
14 None https://github.com/elamani-drawing/CVE-2024-4367-POC-PDFJS POC Details
15 None https://github.com/VVeakee/CVE-2024-4367 POC Details
16 PDF host for CVE-2024-4367 https://github.com/BektiHandoyo/cve-pdf-host POC Details
17 None https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/PDF.js%20%E4%BB%BB%E6%84%8F%20JavaScript%20%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%20CVE-2024-4367.md POC Details
18 https://github.com/vulhub/vulhub/blob/master/pdfjs/CVE-2024-4367/README.md POC Details
19 CVE-2024-4367 https://github.com/Bhavyakcwestern/Hacking-pdf.js-vulnerability POC Details
20 None https://github.com/PenguinCabinet/CVE-2024-4367-hands-on POC Details
21 POC for PDF JS' CVE-2024-4367 vuln https://github.com/pS3ud0RAnD0m/cve-2024-4367-poc POC Details
22 POC https://github.com/MihranGIT/POC_CVE-2024-4367 POC Details
23 None https://github.com/MihranGIT/CVE-2024-4367 POC Details
24 wargame, CVE-2024-4367 https://github.com/m0d0ri205/PDFJS POC Details
25 This Proof of Concept (PoC) demonstrates the exploitation of the CVE-2024-4367 vulnerability, which involves Cross-Site Scripting (XSS) attacks. https://github.com/ahmad-kabiri/CVE-2024-4367-PoC POC Details
26 None https://github.com/0xr2r/CVE-2024-4367 POC Details
27 Odoo ≤17 is vulnerable to CVE-2024-4367, allowing arbitrary JavaScript execution via PDF.js. https://github.com/1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf POC Details
28 This Proof of Concept (PoC) demonstrates the exploitation of the CVE-2024-4367 vulnerability, which involves Cross-Site Scripting (XSS) attacks. https://github.com/kabiri-labs/CVE-2024-4367-PoC POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-4367

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-4367 (4)

Mailing List Discussions for CVE-2024-4367 (2)

Same Patch Batch · Mozilla · 2024-05-14 · 16 CVEs total

CVE-2024-4769 Mozilla Firefox 安全漏洞
CVE-2024-4768 Mozilla Firefox 安全漏洞
CVE-2024-4767 Mozilla Firefox 安全漏洞
CVE-2024-4770 Mozilla Firefox 安全漏洞
CVE-2024-4777 Mozilla Firefox 安全漏洞
CVE-2024-4764 Mozilla Firefox 安全漏洞
CVE-2024-4765 Mozilla Firefox 安全漏洞
CVE-2024-4772 Mozilla Firefox 安全漏洞
CVE-2024-4771 Mozilla Firefox 安全漏洞
CVE-2024-4766 Mozilla Firefox 安全漏洞
CVE-2024-4773 Mozilla Firefox 安全漏洞
CVE-2024-4776 Mozilla Firefox 安全漏洞
CVE-2024-4775 Mozilla Firefox 安全漏洞
CVE-2024-4778 Mozilla Firefox 安全漏洞
CVE-2024-4774 Mozilla Firefox 安全漏洞

IV. Related Vulnerabilities

Same product: Firefox
Same vendor: Mozilla