1585309 - Reflected File Download in PDF.js (Mozilla HTML5 PDF Reader)

Status: RESOLVED INVALID

(Firefox :: PDF Viewer, task)

Description

[koffieprog]

During a penetration test I discovered a vulnerability in PDF.js that allows attackers to serve malware via PDF.js. The attack has a low chance of exploitation but the ability to serve malware makes it a high-impact vulnerability, which isn't permissible by the security model of my customer. The vulnerability can be easily fixed by adding an option to white-list filenames to the library.

Issue description

Under normal circumstances, a PDF file is rendered in the browser via a URL in the format below. The file parameter points to a blob (pre-defined file in JS), and the fileName parameter indicates a filename. The PDF will render in the browser, and the user has an option to download the file using the download button. The fileName parameter is used as the filename to serve the file, when the download button is clicked.

/pdfjs/web/viewer.html?file=blob:<someblob>&fileName=Goodfile.pdf&openFile=false&download=true&viewBookmark=false&print=false&fullScreen=false&find=false

An attacker can abuse these parameters to perform a Reflected File Download attack. The following link points to the file-parameter to /search?q=;shutdown; and has malware.bat as a fileName. If a user opens this link and clicks download, PDF.js will make a request to /search?q=;shutdown; and serve the contents of that page to the user as the file malware.bat. If the q-parameter is rendered on the page, the attacker can control the contents of the served batch file.

/pdfjs/web/viewer.html?file=/search?q=;shutdown;&fileName=malware.bat&openFile=false&download=true&viewBookmark=false&print=false&fullScreen=false&find=false

The fix

Please add an option to white-list filenames and/or file locations to the PDF.js library to make it more secure. The customer currently has to choose between waiting for this fix or removing the library all together and going back to regular PDF downloads.

Contact

For questions about this issue you can contact me on [e-mail]

Comment 1

[Brendan Dahl [:bdahl]]

PDF.js doesn't support a "fileName" parameter by default, so it seems your client is using a customized version of PDF.js. If more filtering is needed on what should be allowed in the "file" parameter then they could modify the viewer themselves here.

Comment 2

[koffieprog]

I'm sorry, I assumed they used the latest version. I've asked the client to update the library or to modify it themselves.