CVE-2024-4367 PoC — Mozilla Firefox 安全漏洞

Description

CVE-2024-4367

Readme

# 🚨 CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js

This project demonstrates and analyzes **CVE-2024-4367**, a high-severity vulnerability in Mozilla’s PDF.js library that allows arbitrary JavaScript execution through improper type checking in font handling code. Our research shows how a maliciously crafted PDF can execute JavaScript in contexts like Electron apps, potentially escalating to remote code execution.

🔗 **GitHub Repository**: [Hacking-pdf.js-vulnerability](https://github.com/Bhavyakcwestern/Hacking-pdf.js-vulnerability)

---

## 📖 Project Overview

- **CVE ID**: CVE-2024-4367  
- **Severity**: High (CVSS v3.1 Score: 8.8)  
- **Affected Software**  
  - PDF.js < 4.2.67  
  - Mozilla Firefox < 126  
  - Firefox ESR < 115.11  
  - Thunderbird < 115.11  
- **Exploit**: Arbitrary JavaScript execution via unsanitized `fontMatrix` in embedded fonts.  
- **Proof of Concept (PoC)**: PDFs `ex1.pdf` and `ex-gist.pdf` show alerts or remote-script execution.

---

## 📂 Repository Contents

- `src/components/ReactPdfViewer.tsx` – React viewer built with react-pdf 5.7.2 (bundles vulnerable pdfjs-dist 2.16.105)  
- `ex1.pdf` – malicious PDF triggering an alert  
- `ex-gist.pdf` – malicious PDF that fetches & executes remote JS  
- `CVE-2024-4367_Report_Hacking_Project.pdf` – full technical report and exploit analysis  

---

## ⚠️ Vulnerability Details

PDF.js’s `fontMatrix` array elements were improperly validated—accepting strings injected directly into JavaScript compiled with `new Function(...)`. This allows attackers to craft malicious font data, causing arbitrary code execution when `eval`-like operations are permitted.

Example vulnerable code path:

```js
fontMatrix = ["alert('XSS')", 0, 0, 1, 0, 0]; // Injected payload
// Results in compiled function like:
function drawGlyph() {
  transform("alert('XSS')", 0, 0, 1, 0, 0); // Unsafe execution
}
```

---

## 🛡️ Mitigation Strategies for CVE-2024-4367

To mitigate this vulnerability and protect applications embedding PDF.js (or libraries that bundle it), adopt the following measures:

### ✅ Upgrade Dependencies
- Upgrade **PDF.js** to **v 4.2.67** (or later) which patches the type-checking flaw.  
- If using wrappers (e.g., **react-pdf**), confirm they ship **pdfjs-dist ≥ 4.2.67**.

### ✅ Disable Dynamic Compilation
- Set **`isEvalSupported = false`** in PDF.js to turn off dynamic `Function` compilation.

### ✅ Enforce Type Checking
- Add explicit `typeof` checks on all user-supplied values (e.g., the `fontMatrix` array).

### ✅ Sanitize Input
- Reject or sanitize any non-numeric input where numbers are expected.

### ✅ Use Dependency Monitoring Tools
- Integrate **Snyk** (or similar) into CI/CD to scan dependencies automatically.  
- Keep `package.json`/`yarn.lock` up-to-date and auto-apply security patches.

### ✅ Keep Browsers & Runtimes Updated
- Run patched versions:  
  - **Firefox ≥ 126**  
  - **Firefox ESR ≥ 115.11**  
  - **Thunderbird ≥ 115.11**  
- Update Electron runtimes so they bundle a secure PDF.js build.

### ✅ Apply Security Headers
Add a strict **Content-Security-Policy**:

```http
Content-Security-Policy: script-src 'self'; object-src 'none';

File Snapshot

Remarks