PT-2024-25799 · Mozilla+1 · Pdf.Js+1

Calixteman + 1 · Published 2024-05-07 · Updated 2026-01-20 · CVE-2024-34342

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions react-pdf versions prior to 7.7.3 react-pdf versions prior to 8.0.2

Description The issue arises when PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true, which is the default value. This configuration allows unrestricted attacker-controlled JavaScript to be executed in the context of the hosting domain.

Recommendations For versions prior to 7.7.3, update to version 7.7.3 or later. For versions prior to 8.0.2, update to version 8.0.2 or later. As a temporary workaround, consider setting the option isEvalSupported to false to minimize the risk of exploitation. Set options.isEvalSupported to false, where options is Document component prop.

Exploit

Fix

Improper Check for Exceptional Conditions

XSS

Weakness Enumeration

CWE-754

CWE-79

Related Identifiers

CVE-2024-34342

GHSA-87HQ-Q4GP-9WR4

GHSA-WGRM-67XF-HHPQ

Affected Products

Pdf.Js

React-Pdf

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34342.json · Exploit
• https://mozilla.org/security/advisories/mfsa2024-23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34342 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34342 · Security Note
• https://osv.dev/vulnerability/GHSA-87hq-q4gp-9wr4 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-21 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wgrm-67xf-hhpq · Vendor Advisory
• https://github.com/mozilla/pdf.js/releases/tag/v4.2.67 · Note
• https://github.com/mozilla/pdf.js · Note
• https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6 · Note
• https://github.com/mozilla/pdf.js/pull/18015 · Note
• https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq · Note
• https://github.com/gogs/gogs/issues/7928 · Note