XSS for PDFs – New injection technique leaves PDF documents ripe for exfiltration

guest · Dec 10, 2020

XSS for PDFs – New injection technique offers rich pickings for security researchers
A lack of input sanitization leaves PDF documents ripe for exfiltration
December 10, 2020
https://portswigger.net/daily-swig/...offers-rich-pickings-for-security-researchers

The contents of PDF documents can be exfiltrated to a remote server using an exploit contained in a single link, potentially exposing a wealth of sensitive information to an attacker.

Security researcher Gareth Heyes of PortSwigger* demonstrated how a newly developed injection technique enabled him to conduct a successful injection attack against a PDF rendered server-side during Black Hat Europe’s online conference today.
Using a single link, Heyes showed how he was able to compromise the contents of a PDF document and exfiltrate it to a remote server, “just like a blind cross-site scripting (XSS) attack”.
Click to expand...

Discussing the potential impact of his newly developed ‘XSS for PDFs’ technique, Heyes told The Daily Swig: “Imagine you can control your company website URL on a shared PDF.

“You inject a PDF injection vector and the victim clicks your link or anywhere in the PDF and you can extract all the sensitive information they entered.”
Vulnerable software
Heyes found two libraries that were vulnerable to the exploit: PDF-Lib, which has more than 52,000 weekly downloads, and jsPDF, which has around 250,000. Both are NPM modules.
Click to expand...

Check out Heyes’s technical blog post, Portable Data exFiltration: XSS for PDFs, for full details.
Click to expand...

Portable Data exFiltration: XSS for PDFs

PDF documents and PDF generators are ubiquitous on the web, and so are injection vulnerabilities. Did you know that controlling a measly HTTP hyperlink can provide a foothold into the inner workings of a PDF? In this paper, you will learn how to use a single link to compromise the contents of a PDF and exfiltrate it to a remote server, just like a blind XSS attack.

I'll share how I was able to use a custom JavaScript enumerator on the various PDF objects to discover functions that make external requests, enabling me to to exfiltrate data from the PDF. Even PDFs loaded from the filesystem in Acrobat, which have more rigorous protection, can still be made to make external requests.
Click to expand...

Log in or Sign up

XSS for PDFs – New injection technique leaves PDF documents ripe for exfiltration

guest Guest

Log in or Sign up

XSS for PDFs – New injection technique leaves PDF documents ripe for exfiltration

guest Guest

Useful Searches