Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-4367-PoC — CVE-2024-4367 & CVE-2024-34342 Proof of Concept | Kitploit
Tools/GitHubGitHub/lourc0d3/cve-2024-4367-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingPayload Development
GitHublourc0d3/cve-2024-4367-poc

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342 Proof of Concept

View Repository
2032832 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

  • JS Execution
root@kitploit:~
python3 CVE-2024-4367.py "alert(document.domain)"

PoC_JS

  • OS Command Execution (only Electron based)
root@kitploit:~
python3 CVE-2024-4367.py "require('child_process').exec('open -a /Applications/Calculator.app');"

PoC_OS

This is not my bug, I just made a PoC for it.

Reference

  • https://github.com/advisories/GHSA-wgrm-67xf-hhpq
  • https://nvd.nist.gov/vuln/detail/CVE-2024-4367
Download Tool