GoogleOSV:GHSA-87HQ-Q4GP-9WR4react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
0.0004 Low
EPSS
Percentile
10.4%
Summary
If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
This patch forces isEvalSupported to false, removing the attack vector.
Workarounds
Set options.isEvalSupported to false, where options is Document component prop.
References
References
github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
github.com/mozilla/pdf.js/pull/18015
github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
github.com/wojtekmaj/react-pdf
github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe
github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad
github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4
nvd.nist.gov/vuln/detail/CVE-2024-34342
Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
0.0004 Low
EPSS
Percentile
10.4%