4

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.

The user input is accepted as is, without encoding or any other modification. This behaviour is usually exploitable. For instance with csv files you could inject formulas. On web applications this obviously opens up XSS.

Are there any attack vectors for PDF files or the PDF generator in the background with unfiltered user input?

Improve this question
2
  • How does that user input end up into the PDF? The application treats it as text and uses some library to generate a PDF from it?
    – Martin Schröder
    Jul 22, 2018 at 14:13
  • @MartinSchröder I had multiple options. Plain text, which is directly input at various places. I could add plaintext files, PDFs and images which were displayed among one of the generated pages.
    – GarlicCheese
    Jul 31, 2018 at 6:29

1 Answer 1

Reset to default
-1

What you need to worry is

  1. Whether the website sanitize the user input. So in case of XSS, malicious code will not be injected.

  2. Reputation of the web services that generate the PDF file. Acrobat reader exploit code can always be injected into the PDF file.

This is better than worry about than learning all sort of PDF object that are exploitable by attacker.

Improve this answer
2
  • 1
    As I said I'm testing a web application, not developing one. I'm trying to find a proof of concept, why the developers approach of not sanitizing is bad. Thanks for the link, I'll look into it.
    – GarlicCheese
    Jul 17, 2018 at 12:01
  • @GarlicCheese : well, I just rephrase the answer.
    – mootmoot
    Jul 17, 2018 at 12:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .