CVE-2024-4367: Stored XSS via PDFjs
Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches The patch removes the use of eval: https://github.com/mozilla/pdf.js/pull/18015
Workarounds Set the option isEvalSupported to false.
References https://bugzilla.mozilla.org/showbug.cgi?id=1893645
Other sources
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
— Mozilla
Mitigations were made to take care of vulnerability in PDF.js CVE-2024-4367.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 130.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 115.15.0esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 115.15.0esr-1~deb12u1Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/odooto a version that resolves this vulnerability.Fixed in 14.0.0+dfsg.2-7+deb11u2Fixed in 16.0.0+dfsg.2-3 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.2.1esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 126 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
npm/pdfjs-distto a version that resolves this vulnerability.Fixed in 4.2.67 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.11 - Configuration
Set PDF.js option `isEvalSupported` to `false` to prevent attacker-controlled JavaScript execution via PDF handling (CVE-2024-4367).
PDF.js isEvalSupported = false
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2024-4367
- CVE-2024-4767
- CVE-2024-4768
- CVE-2024-4769
- CVE-2024-4770
- CVE-2024-4777
- CVE-2024-4764
- CVE-2024-4765
- CVE-2024-4766
- CVE-2024-4771
- CVE-2024-4772
- CVE-2024-4773
- CVE-2024-4774
- CVE-2024-4775
- CVE-2024-4776
- CVE-2024-10941
- CVE-2024-4778
- CVE-2024-4835
- CVE-2024-2874
- CVE-2023-7045
- CVE-2024-5258
- CVE-2023-6502
- CVE-2024-1947
- CVE-2024-5318
Frequently Asked Questions
What is the severity of CVE-2024-4367?
CVE-2024-4367 is assigned a critical severity due to the potential execution of unrestricted attacker-controlled JavaScript.
How do I fix CVE-2024-4367?
To fix CVE-2024-4367, update to the latest version of affected software, such as Firefox or Thunderbird, which includes the necessary patches.
What versions are affected by CVE-2024-4367?
CVE-2024-4367 affects versions of Firefox ESR up to 115.11 and Thunderbird up to 115.11.
What is the main risk associated with CVE-2024-4367?
The main risk of CVE-2024-4367 is that it allows attackers to execute malicious JavaScript within the context of the hosting domain.
Who is impacted by CVE-2024-4367?
Users of Mozilla Firefox ESR and Thunderbird, especially those utilizing pdf.js with eval support enabled, are at risk from CVE-2024-4367.