3 ms·
The impact here is XSS or possible RCE for electron. > In applications that embed PDF.js, the impact is potentially even worse. If no mitigations are in place
by kyrra 2y ago
The impact here is XSS or possible RCE for electron.
> In applications that embed PDF.js, the impact is potentially even worse. If no mitigations are in place (see below), this essentially gives an attacker an XSS primitive on the domain which includes the PDF viewer. Depending on the application this can lead to data leaks, malicious actions being performed in the name of a victim, or even a full account take-over. On Electron apps that do not properly sandbox JavaScript code, this vulnerability even leads to native code execution (!). We found this to be the case for at least one popular Electron app.
- plingbang 2y agoI remember MS Teams opening various files within itself instead of launching an appropriate program. I wonder what they're using for rendering PDFs.
- gostsamo 2y agoAt least edge uses a module from word as far as I know and I'd expect the same for teams. They likely are not affected.
- Gare 2y agoThat's why I use MS Teams (on desktop) via browser only. Keeps it nicely sandboxed.
- yencabulator 2y agoAnd if they had used PDF.js incorrectly in the browser, it would allow XSS attacks on the domain used for MS Teams.
- mattsan 2y agoHaven't tested but I'm almost certain the Electron app they're talking about is VS Code. Wouldn't make sense for a code editor to sandbox extensions
- notnullorvoid 2y agoI don't believe they are talking about a VS Code extension embedding PDF.js but rather an Electron app that has PDF.js embedded by default. My guess is Slack.