I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.

The user input is accepted as is, without encoding or any other modification. This behaviour is usually exploitable. For instance with csv files you could inject formulas. On web applications this obviously opens up XSS.

Are there any attack vectors for PDF files or the PDF generator in the background with unfiltered user input?

  • How does that user input end up into the PDF? The application treats it as text and uses some library to generate a PDF from it? Jul 22, 2018 at 14:13
  • @MartinSchröder I had multiple options. Plain text, which is directly input at various places. I could add plaintext files, PDFs and images which were displayed among one of the generated pages. Jul 31, 2018 at 6:29

1 Answer 1


What you need to worry is

  1. Whether the website sanitize the user input. So in case of XSS, malicious code will not be injected.

  2. Reputation of the web services that generate the PDF file. Acrobat reader exploit code can always be injected into the PDF file.

This is better than worry about than learning all sort of PDF object that are exploitable by attacker.

  • 1
    As I said I'm testing a web application, not developing one. I'm trying to find a proof of concept, why the developers approach of not sanitizing is bad. Thanks for the link, I'll look into it. Jul 17, 2018 at 12:01
  • @GarlicCheese : well, I just rephrase the answer.
    – mootmoot
    Jul 17, 2018 at 12:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .