Understanding the Critical JavaScript Flaws CVE 2024 4367 and CVE 2024 34342
Blog Summary
• Critical JavaScript vulnerabilities CVE-2024-4367 and CVE-2024-34342 affect PDF.js and React-PDF, potentially allowing attackers to execute arbitrary code. Millions of users could be exposed to data theft or unauthorized actions. Upgrading to the patched versions and disabling isEvalSupported mitigates these risks, protecting sensitive information and maintaining secure PDF rendering in web applications.
Table of contents
What is Vulnerability?
Recent discoveries have unearthed significant security flaws in PDF.js and React-PDF, both widely used for PDF viewing in web applications. These vulnerabilities, identified as CVE-2024-4367 and CVE-2024-34342, arise from improper handling of JavaScript within PDF files, allowing for the execution of arbitrary JavaScript code.
Impact
These vulnerabilities impact millions of users by potentially allowing attackers to steal sensitive information like cookies and session tokens, or perform actions on behalf of the user without their consent.
Affected Applications and Versions
PDF.js: Versions up to 4.1.392 are vulnerable.
React-PDF: Affects versions up to 7.7.2 and from 8.0.0 to 8.0.1.
Trigger Mechanism
The flaw is triggered when a malicious PDF is loaded by PDF.js or React-PDF with the isEvalSupported setting enabled, which is true by default.
Recommendations
It is recommended that users upgrade to the following versions to ensure security:
PDF.js: Version 4.2.67 or later.
React-PDF: Version 7.7.3 or 8.0.2 and beyond.
It's also recommended to set isEvalSupported to false to prevent the execution of potentially malicious scripts.
To fix your vulnerable patches, please visit the PDF.js and React-PDF patch release pages.
FAQs
They are critical JavaScript vulnerabilities in PDF.js and React-PDF allowing arbitrary code execution when PDFs are loaded with isEvalSupported enabled.
PDF.js up to 4.1.392; React-PDF up to 7.7.2 and 8.0.0–8.0.1.
Attackers could steal sensitive data like cookies or session tokens, or perform actions on behalf of users without consent.
Upgrade to PDF.js 4.2.67+, React-PDF 7.7.3 or 8.0.2+, and set isEvalSupported to false.
Visit the official PDF.js and React-PDF patch release pages for downloads and instructions.
Posted Date
14 May 2024
Category
Cybersecurity Advisories
Author Name
Amber Innovations