I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.

The user input is accepted as is, without encoding or any other modification. This behaviour is usually exploitable. For instance with csv files you could inject formulas. On web applications this obviously opens up XSS.

Are there any attack vectors for PDF files or the PDF generator in the background with unfiltered user input?

  • How does that user input end up into the PDF? The application treats it as text and uses some library to generate a PDF from it? – Martin Schröder Jul 22 '18 at 14:13
  • @MartinSchröder I had multiple options. Plain text, which is directly input at various places. I could add plaintext files, PDFs and images which were displayed among one of the generated pages. – GarlicCheese Jul 31 '18 at 6:29

What you need to worry is

  1. Whether the website sanitize the user input. So in case of XSS, malicious code will not be injected.

  2. Reputation of the web services that generate the PDF file. Acrobat reader exploit code can always be injected into the PDF file.

This is better than worry about than learning all sort of PDF object that are exploitable by attacker.

| improve this answer | |
  • 1
    As I said I'm testing a web application, not developing one. I'm trying to find a proof of concept, why the developers approach of not sanitizing is bad. Thanks for the link, I'll look into it. – GarlicCheese Jul 17 '18 at 12:01
  • @GarlicCheese : well, I just rephrase the answer. – mootmoot Jul 17 '18 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.