corbel/tests/fixtures/cve_writeup.md

CVE-2024-1234: PDF JavaScript Injection

Abstract

In this paper we describe a vulnerability in which a malicious PDF uses a /JavaScript action to execute arbitrary code. The eval() function is called with attacker-controlled input.

Proof of Concept

# This is a PoC for the vulnerability described above.
import subprocess
# Note: this code is for educational purposes only.
payload = "eval('alert(1)')"
print(f"Payload: {payload}")

Remediation

Patch the reader to ignore /JavaScript actions in /OpenAction.