Lucene search

GitHub_MCVELIST:CVE-2024-34342

HistoryMay 07, 2024 - 2:29 p.m.

CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-0714:29:06

CWE-79

GitHub_M

www.cve.org

cve-2024-34342

react-pdf

pdf.js

arbitrary javascript execution

malicious pdf

vulnerability

fixed

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

0.0004 Low

EPSS

Percentile

10.5%

JSON

react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.

CNA Affected

[
  {
    "vendor": "wojtekmaj",
    "product": "react-pdf",
    "versions": [
      {
        "version": "< 7.7.3",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0, < 8.0.2",
        "status": "affected"
      }
    ]
  }
]

References

github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6

github.com/mozilla/pdf.js/pull/18015

github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq

github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe

github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad

github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

0.0004 Low

EPSS

Percentile

10.5%

JSON

Related for CVELIST:CVE-2024-34342