22 lines
537 B
Markdown
Executable File
22 lines
537 B
Markdown
Executable File
# CVE-2024-1234: PDF JavaScript Injection
|
|
|
|
## Abstract
|
|
|
|
In this paper we describe a vulnerability in which a malicious PDF
|
|
uses a /JavaScript action to execute arbitrary code. The eval() function
|
|
is called with attacker-controlled input.
|
|
|
|
## Proof of Concept
|
|
|
|
```python
|
|
# This is a PoC for the vulnerability described above.
|
|
import subprocess
|
|
# Note: this code is for educational purposes only.
|
|
payload = "eval('alert(1)')"
|
|
print(f"Payload: {payload}")
|
|
```
|
|
|
|
## Remediation
|
|
|
|
Patch the reader to ignore /JavaScript actions in /OpenAction.
|