{"id":24159443,"url":"https://github.com/exfil0/weaponizing-cve-2024-4367","last_synced_at":"2025-08-02T08:35:44.281Z","repository":{"id":271109736,"uuid":"912425407","full_name":"exfil0/WEAPONIZING-CVE-2024-4367","owner":"exfil0","description":"CVE-2024-4367 is a critical vulnerability (CVSS 9.8) in PDF.js, allowing arbitrary JavaScript code execution due to insufficient type checks on the FontMatrix object within PDF files.","archived":false,"fork":false,"pushed_at":"2025-01-05T19:21:50.000Z","size":290,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-24T21:05:41.765Z","etag":null,"topics":["cve-2024-4367","spyware","weaponized"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/exfil0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-01-05T14:44:01.000Z","updated_at":"2025-06-10T04:02:06.000Z","dependencies_parsed_at":"2025-01-05T15:39:19.816Z","dependency_job_id":"992d862b-66fc-4bcc-b0ac-6cf43b3d5d22","html_url":"https://github.com/exfil0/WEAPONIZING-CVE-2024-4367","commit_stats":null,"previous_names":["exfil0/weaponizing-cve-2024-4367"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/exfil0/WEAPONIZING-CVE-2024-4367","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/exfil0%2FWEAPONIZING-CVE-2024-4367","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/exfil0%2FWEAPONIZING-CVE-2024-4367/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/exfil0%2FWEAPONIZING-CVE-2024-4367/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/exfil0%2FWEAPONIZING-CVE-2024-4367/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/exfil0","download_url":"https://codeload.github.com/exfil0/WEAPONIZING-CVE-2024-4367/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/exfil0%2FWEAPONIZING-CVE-2024-4367/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268355767,"owners_count":24237367,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-02T02:00:12.353Z","response_time":74,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2024-4367","spyware","weaponized"],"created_at":"2025-01-12T15:17:31.318Z","updated_at":"2025-08-02T08:35:44.256Z","avatar_url":"https://github.com/exfil0.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WEAPONIZING-CVE-2024-4367\nCVE-2024-4367 is a critical vulnerability (CVSS 9.8) in PDF.js, allowing arbitrary JavaScript code execution due to insufficient type checks on the FontMatrix object within PDF files.\n\n# CVE-2024-4367 Exploit Wizard: User Guide\n\n| **CVE IDENTIFIER** | **CVE-2024-4367** |\n|--------------------|-------------------|\n| **SEVERITY**       | Critical (CVSS Score: 9.8) |\n| **VULNERABILITY**  | Arbitrary JavaScript code execution in PDF.js due to insufficient type checks on FontMatrix object |\n| **EXPLOITATION**   | Maliciously crafted PDF files can execute JavaScript in the victim’s browser, leading to data theft, XSS, or RCE. |\n\n---\n\n## 1. Environment Setup\n\n### Prerequisites\n\n1. **Operating System**:\n   - A Debian/Ubuntu-based Linux distribution or equivalent, with administrative privileges.\n   - Ensure Python 3.x is installed (`python3 --version`).\n\n2. **Script Setup**:\n   - Save the exploit script in a directory of your choice (e.g., `~/cve-2024-4367/`) with the filename `cve_2024_4367_exploit_wizard.py`.\n\n3. **Template PDF**:\n   - Place a benign PDF file named `template.pdf` in the same directory. This file will serve as the base for the malicious PDF.\n\n4. **Social Engineering Toolkit (SET)**:\n   - Install SET (Social Engineering Toolkit):\n     ```bash\n     sudo apt-get update\n     sudo apt-get install set\n     ```\n   - Verify installation with:\n     ```bash\n     which setoolkit\n     ```\n\n---\n\n## 2. Running the Exploit Wizard\n\n### Step 1: Make the Script Executable (Optional)\n\nGrant executable permissions to the script:\n```bash\nchmod +x cve_2024_4367_exploit_wizard.py\n```\n\n### Step 2: Execute the Script\n\nRun the script using either method below:\n```bash\n./cve_2024_4367_exploit_wizard.py\n```\n**or**\n```bash\npython3 cve_2024_4367_exploit_wizard.py\n```\n\n### Step 3: Follow On-Screen Prompts\n\nThe script will guide you through the attack process step-by-step.\n\n---\n\n## 3. Step-by-Step Wizard Workflow\n\n### **Step 1: Verify and Install Dependencies**\n\n- The script automatically checks for:\n  - **PyPDF2**: Required for manipulating PDFs.\n  - **SET**: Used for phishing campaigns.\n- Missing dependencies will be installed automatically (or prompt for manual installation).\n\n### **Step 2: Create a Malicious PDF**\n\n- The script injects a JavaScript payload into the `/FontMatrix` field of the `template.pdf`.\n- The output, `malicious.pdf`, will be saved in the same directory.\n- Success or failure will be displayed.\n\n### **Step 3: Manage Campaign Targets**\n\n- Add target emails (or identifiers) interactively.\n- Type each target email one by one.\n- Finalize the list by typing `done`.\n\n### **Step 4: Launch Social Engineering Toolkit (SET)**\n\n- The script integrates with SET to deliver the malicious PDF via phishing.\n- Follow SET’s prompts to configure the campaign:\n  - Set up email templates.\n  - Attach `malicious.pdf`.\n- Exit SET to return to the wizard.\n\n### **Step 5: Host Malicious PDF**\n\n- The script launches an HTTP server at `http://localhost:8080`.\n- `malicious.pdf` is accessible for download.\n- Data exfiltrated by the payload (e.g., `document.cookie`) will be logged in the script’s console.\n\n---\n\n## 4. Testing the Exploit\n\n### **Validate in a Controlled Environment**\n\n1. Open `malicious.pdf` in a vulnerable version of PDF.js or a sandboxed VM.\n2. Monitor server logs to confirm payload execution and data exfiltration.\n\n### **Observe Exfiltration Logs**\n\n- Data (e.g., cookies) submitted by the payload will be logged as:\n  ```\n  [+] Data exfiltrated: session_id=abcd1234; auth_token=xyz987\n  ```\n\n### **Modify Payload for Additional Tests**\n\n- Customize the payload for actions like keylogging or redirection.\n- Test your environment’s ability to detect or mitigate these threats.\n\n---\n\n## 5. Cleanup and Post-Execution Tasks\n\n### Stop the Local Server\n\nTerminate the HTTP server using `Ctrl+C` in the terminal.\n\n### Secure Malicious Assets\n\n- Delete or securely store `malicious.pdf` to prevent accidental misuse.\n- Safely archive any logs or campaign data.\n\n### Reset Test Environment\n\n- If using a virtual machine, revert to a clean snapshot.\n- Ensure no malicious artifacts remain on the system.\n\n---\n\n## 6. Important Notes and Legal Disclaimer\n\n### **For Authorized Use Only**\n\n- This script and guide are intended for **educational purposes** and **authorized penetration testing** within controlled environments.\n- Unauthorized use is illegal and may result in severe legal consequences.\n- Always obtain explicit permission before conducting any exploit tests.\n\n### **Securing Your Systems**\n\n1. **Update PDF.js**:\n   - Ensure the latest version of PDF.js is installed to patch CVE-2024-4367.\n\n2. **Restrict JavaScript in PDFs**:\n   - Disable JavaScript execution in PDF viewers whenever possible.\n\n3. **Implement Endpoint Protection**:\n   - Use robust endpoint detection and response tools.\n\n4. **Educate Users**:\n   - Train employees to recognize phishing attempts and avoid opening unverified PDFs.\n\n---\n\nBy following this guide responsibly, you can effectively simulate real-world attack scenarios and bolster your cybersecurity defenses.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexfil0%2Fweaponizing-cve-2024-4367","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fexfil0%2Fweaponizing-cve-2024-4367","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexfil0%2Fweaponizing-cve-2024-4367/lists"}