Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-4367-Analysis — Analysis and PoC for CVE-2024-4367: arbitrary JavaScript execution (XSS) in PDF.js | Kitploit
Tools/GitHubGitHub/masamuneee/cve-2024-4367-analysis
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPapers & ResearchLearning & Education
GitHubmasamuneee/cve-2024-4367-analysis

CVE-2024-4367-Analysis

Analysis and PoC for CVE-2024-4367: arbitrary JavaScript execution (XSS) in PDF.js

View Repository
411 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js

Overview

CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting (XSS) attacks. This affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Usages

Node in /app

root@kitploit:~
npm install
root@kitploit:~
npm start

PoC

  • python3 poc.py <payload>
  • Example: python3 poc.py "alert(1)"

Demo Videos

  • Demo 1 (Firefox)
  • Demo 2 (pdfjs-dist)

Mitigation

  • Update PDF.js to a version higher than 4.1.392.
  • Ensure your Firefox, Firefox ESR, or Thunderbird is up-to-date with the latest security patches.

Detailed Analysis

For a comprehensive analysis of CVE-2024-4367, read here.

PoC references

  • https://github.com/LOURC0D3/CVE-2024-4367-PoC
  • https://github.com/s4vvysec/CVE-2024-4367-POC
Download Tool