aaronxu/vulhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit
Some checks failed
Vulhub Format Check and Lint / format-check (push) Has been cancelled
Details
Vulhub Format Check and Lint / markdown-check (push) Has been cancelled
Details
Vulhub Docker Image CI / longtime-images-test (push) Has been cancelled
Details
Vulhub Docker Image CI / images-test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Aaron
2025-09-06 16:08:15 +08:00
commit 63285f61aa
2624 changed files with 88491 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
pdfjs/CVE-2024-4367/README.md Normal file
View File

@@ -0,0 +1,27 @@
# PDF.js Arbitrary JavaScript Code Execution (CVE-2024-4367)
[中文版本(Chinese version)](README.zh-cn.md)
PDF.js is a Portable Document Format (PDF) viewer that is built with HTML5.
In the PDF.js version prior to 4.1.392, a JavaScript code injection was found. This bug allows an attacker to execute arbitrary JavaScript code as soon as a malicious PDF file is opened.
References:
- <https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/>
## Vulnerable environment
Execute following command to start a server that contains PDF.js 4.1.392:
```
docker compose up -d
```
After the server is started, browse `http://your-ip:8080` you will see an uploading page.
## Vulnerability reproduce
Upload malicious PDF file [poc.pdf](poc.pdf) to trigger the XSS:
![](1.png)