2

Context

On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files.

I was wondering if this could come with security issues.

The uploaded PDF are simply displayed on the website thanks to: <embed ... type="application/pdf"></embed>.

Question

Doing some reasearch, I stumbled upon this gist: https://gist.github.com/andripwn/671ef1aa6c535d9168c900524bfb84e1 which suggests that what I do could lead to XSS attacks. I tried the code and it works: an alert is displayed on my website.

But is it really a security risk though? I'm not sure. It seems that the JS code is not normal JS, it's JS for Acrobat (https://opensource.adobe.com/dc-acrobat-sdk-docs/acrobatsdk/pdfs/acrobatsdk_jsapiref.pdf).

  • Is it really a XSS? How could this be exploited?
  • Are there other risks that I'm not aware of?

1 Answer 1

0

This is XSS by definition, as javascript code is being injected client-side. This can be exploited by extending the publicly available proof-of-concept code.

Possible effects of this form of XSS:

  • Injecting arbitrary images (ads, explicit content)

  • Fingerprinting any visitors. Cursory look at the docs reveals: app.language app.viewerType app.viewerVersion app.properties app.plugins app.printColorProfile app.runtimeHighlightColor TTS.numSpeakers MediaSettings.players monitor.colorDepth TTS.talk spell.languages(Order). There are certainly additional functions that can be paired with these to form a unique profile, however sending the data cross-site becomes a bit complicated, bringing me into my next point.

  • [most likely/dangerous] Injecting a script from an attacker-controlled domain with <script src="..."> (this is what would technically make this an XSS or cross site scripting attack). Attackers usually try to steal auth tokens here, so that would compromise any accounts that visited the malicious PDF. Adobe has actually tried to mitigate this by allowing warnings upon cross-site communication to be set, but I believe it is disabled by default. Here and here are Adobe's docs to harden against cross-domain attacks. Evidently this is possible and a risk if there is security hardening available, but I personally don't use JS often enough to write a sample PoC (if someone else does, feel free to post it as an answer or edit mine).

Mitigations: validate any PDFs sent in for js content and/or edit Acrobat's SecurityPolicy.

2
  • Thank you for your response! > "This can be exploited by using the publicly available proof-of-concept code." -- I didn't find any PoC exploit written in JavaScript for Acrobat. I couldn't find proof that it's possible to fingerprint visitors or to inject a script thanks to this. That's the reason why I asked the question. Do you have examples of "publicly available proof-of-concept code" that exploit this?
    – SitAmet
    Apr 12, 2022 at 18:57
  • @SitAmet There don't exist public PoCs specifically for this, however it's likely possible that they can be crafted by a knowledgeable attacker (I edited my answer with more detail)
    – belkarx
    Apr 12, 2022 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .