CVE-2024-4367
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 5.6epss 73%
from disclosure to weapon6 days
Published on NVDMay 14
1st PoC+6d
exploitation probability
73%top 1% of all CVEs
observed exploitation
nono source reports it
27 public exploit(s)
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
public PoCs found — 27
cve_referencewww.exploit-db.com/exploits/52273unverifiedgithubgithub.com/LOURC0D3/CVE-2024-4367-PoC★ 203githubgithub.com/s4vvysec/CVE-2024-4367-POC★ 57githubgithub.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed★ 12githubgithub.com/spaceraccoon/detect-cve-2024-4367★ 11githubgithub.com/snyk-labs/pdfjs-vuln-demo★ 10githubgithub.com/UnHackerEnCapital/PDFernetRemotelo★ 6githubgithub.com/Masamuneee/CVE-2024-4367-Analysis★ 4githubgithub.com/clarkio/pdfjs-vuln-demo★ 4githubgithub.com/1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf★ 2githubgithub.com/pS3ud0RAnD0m/cve-2024-4367-poc★ 1githubgithub.com/avalahEE/pdfjs_disable_eval★ 1githubgithub.com/kabiri-labs/CVE-2024-4367-PoC★ 1githubgithub.com/elamani-drawing/CVE-2024-4367-POC-PDFJS★ 1githubgithub.com/AnomalousVectors/cve-2024-4367-poc★ 1githubgithub.com/veronimo669/pdf.js-CVE-2024-4367★ 1githubgithub.com/0xr2r/CVE-2024-4367★ 0githubgithub.com/Bhavyakcwestern/Hacking-pdf.js-vulnerability★ 0githubgithub.com/xiaoqiesec0x1/CVE-2024-4367-PDF.js-xss★ 0githubgithub.com/J1nKsC/CVE-2024-4367_test★ 0githubgithub.com/m0d0ri205/PDFJS★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on-01★ 0githubgithub.com/BektiHandoyo/cve-pdf-host★ 0githubgithub.com/VVeakee/CVE-2024-4367★ 0githubgithub.com/PenguinCabinet/CVE-2024-4367-hands-on★ 0githubgithub.com/pedrochalegre7/CVE-2024-4367-pdf-sample★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645https://cert-portal.siemens.com/productcert/html/ssa-827383.htmlhttps://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/http://seclists.org/fulldisclosure/2024/Aug/30https://github.com/gogs/gogs/issues/7928https://github.com/mozilla/pdf.js/releases/tag/v4.2.67https://lists.debian.org/debian-lts-announce/2024/05/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00012.htmlhttps://www.exploit-db.com/exploits/52273https://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/