Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

预览pdf文件，pdf构造任意js代码，造成XSS攻击 #600

Open
Ljdh opened this issue Oct 22, 2024 · 5 comments
Open

预览pdf文件，pdf构造任意js代码，造成XSS攻击 #600

Ljdh opened this issue Oct 22, 2024 · 5 comments

Comments

@Ljdh
Copy link

Ljdh commented Oct 22, 2024

请问pdf文件中包含恶意js代码，xss攻击如何解决？
是否需要升级pdf.js组件，如何升级？
@gaoxingzaq
Copy link
Contributor

转换成 图片模式

@gaoxingzaq
Copy link
Contributor

发个 可以攻击的文件 我看看

@Ljdh
Copy link
Author

Ljdh commented Oct 25, 2024

poc.pdf
这个是可以攻击的文件

@gaoxingzaq
Copy link
Contributor

恩，看到了需要升级pdf.js版本 我记得这块爆了漏洞 影响版本不少啊

@zhangxu2814
Copy link

12月我们公司被网安上门签字了，然后主管就把kkfile关闭了

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@zhangxu2814 @Ljdh @gaoxingzaq and others