CVE-2024-34342: react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Summary
If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches This patch forces isEvalSupported to false, removing the attack vector.
Workarounds Set options.isEvalSupported to false, where options is Document component prop.
References - GHSA-wgrm-67xf-hhpq - https://github.com/mozilla/pdf.js/pull/18015 - https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6 - https://bugzilla.mozilla.org/showbug.cgi?id=1893645
Other sources
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34342?
CVE-2024-34342 is classified as a critical severity vulnerability as it allows unrestricted execution of attacker-controlled JavaScript in the context of the hosting domain.
How do I fix CVE-2024-34342?
To fix CVE-2024-34342, update to react-pdf version 8.0.2 or 7.7.3, ensuring that isEvalSupported is set to false in the PDF.js configuration.
Who is affected by CVE-2024-34342?
CVE-2024-34342 affects applications using PDF.js with isEvalSupported set to true while loading untrusted PDFs.
What versions of react-pdf are vulnerable to CVE-2024-34342?
Versions of react-pdf between 8.0.0 and 8.0.2, as well as any version below 7.7.3, are vulnerable to CVE-2024-34342.
What is the impact of CVE-2024-34342?
The impact of CVE-2024-34342 includes the potential execution of malicious JavaScript, leading to data theft, session hijacking, or other malicious actions within the hosting domain.