0

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus is converted into a PDF using one of the popular programmatic html to pdf conversion libraries (eg. in nodejs or python), and a user opens that PDF, is there any chance at all that the PDF itself is infected as well?

2
  • Not enough for an answer, but yes, it's possible. It depends on a lot of factors such as what the malicious code is, how/with what application the pdf is opened, and what software was used to convert the page to a pdf in the first place. eecis.udel.edu/~hnw/paper/dsn14.pdf (JS functions in pdf's is really all you need to know) – TCooper Nov 19 '20 at 23:33
  • Hi, thanks for the answer! Do you think your answer would change if I were to display the pdf in an iframe? – elypros Nov 19 '20 at 23:56
2

I don't think it's possible. Usually, the library will render only the visual part of the page into a PDF, and not the embedded javascript, needed plugins or anything else. It's basically a screenshot.

Although it's possible to a specially crafted HTML page crash the library, perhaps executing code because of this, it would not reflect on the resulting PDF file. Depending on the attack, it would not even generate any file.

But I don't think anyone would create a crafted page attack a library in a way that generated a crafted PDF to attack your PDF reader.

1

is there any chance at all that the file is infected?

Whenever you ask that is there any chance, almost always the answer will be Yes, it can be infected. Those chances could be infinitesimal, but a contrived enough scenario would likely find a way for it to be infected.

I assume you want to sanitize untrusted web pages in an sandbox enviroment, which are then moved to a "trusted" system which is itself isolated from the internet (otherwise, the malicious web page could simply contain a link to the real malicious page, with the pdf just keeping it¹).

It would be quite hard that a malicious page converts into a malicious pdf. I don't think such html→pdf conversion library would insert scripts in the pdf or invalid data that would result in an escape from the pdf reader.

Rather than finding a pdf exploit that can be expressed in a way that survives conversion from html, it would be easier to get an exploit for the html to pdf converter. After owning the converter process, it'd be trivial to make it output any arbitrary content.

So yes, it would be possible, at the cost of obtaining that second exploit.

A more secure approach would be to convert it to a safer format. You could convert it to an image, having another process validate that it is indeed a valid image, You can see this idea on the blog post Converting untrusted PDFs into trusted ones: The Qubes Way by Joanna Rutkowska. It was dealing with converting untrusted pdf to trusted pdf, but it is applicable as well to your case of html to pdf. They go so far to convert it into rgb values, in order to remove any vulnerabilities on the image decompressor as well.

It would already be extremely hard (even for exploit levels) to get a browser exploit which worked with javascript disabled. Showing only the converted image should remove all the technical risk inherent to visiting the web page.

Of course, that is of no help for PEBKAC exploits, where the user would be tricked by the web page content to e.g. send an email with their password to the attacker.

.

¹ Plus, typically, you would have the exploit on the first stage, but it actually being a dropper which downloads the next one from the internet. While it might be possible to bundle everything together on a single file, it's uncommon.

3
  • Thanks for such a detailed answer! Definitely answered a lot of my concerns – elypros Nov 21 '20 at 3:50
  • Just to add for future reference (at least until comments are wiped) - there is a possibility to add "javscript" to PDFs - we use it in some of our applications to automatically open a print dialog and prefill some of it's parameters when the file is open. So, if you use a library that is smart enough to try to use some form of javascript in your PDF based on anything the users input it is technically possible to make a page that would be converted to a PDF with some sort of malicious script, but IMHO it requires targeted attack exploting multiple vulnerabilities in specific solution. – mishan Nov 24 '20 at 10:00
  • @mishan yes, it is possible to include javascript in pdf. It is an useful feature for exploits, even. However, I don't think the html-to-pdf library would create pdf javascript from a html page that had javascript embedded in the html. – Ángel Nov 24 '20 at 22:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.