4 ms·

PDF also has script support unfortunately.

• mikkupikku 10mo ago
  That's apparently how 4chan got hacked a while back. They were letting users upload PDFs and were using ghostscript to generate thumbnails. From what I understand, the hackers uploaded a PDF which contained PostScript which exploited a ghostscript bug.
  • diath 10mo ago
    Yes but the primary issue was that 4chan was using over a decade old version of the library that contained a vulnerability first disclosed in 2012: https://nvd.nist.gov/vuln/detail/CVE-2012-4405 https://nvd.nist.gov/vuln/detail/CVE-2012-4405
• jonahx 10mo ago
  Does that mean that opening arbitrary pdfs on your laptop is unsafe?
  • bmacho 10mo ago
    Yes, opening random pdfs especially in random and old pdf viewers is not a good idea. If you must open a possibly infected pdf, then do it in browser, pdf.js is considered mostly safe, and updated.
    • rvnx 10mo ago
      Use the PDF to JPG online services, convenient and you still get your result without having to deal with any sandbox
      • bpt3 10mo ago
        Except of course that you're sharing the contents of that PDF with a random online service.
        • rvnx 10mo ago
          True, I just considered that once you handle a PDF with so much care like if it was poisoned, it's perhaps better to send this poison to someone else to handle.
  • Sohcahtoa82 10mo ago
    Let me put it this way... In one of my penetration testing training classes, in one of the lessons, we generated a malicious PDF file that would give us a shell when the victim opened it in Adobe. Granted, it relied on a specific bug in the JavaScript engine of Adobe Reader, so unless they're using a version that's 15 years old, it wouldn't work today, but you can't be too cautious. 0-days can always exist.