From Open Redirect to JavaScript Execution via CVE-2024-4367
DOI:
https://doi.org/10.14421/jiska.6353Keywords:
CVE-2024-4367, PDF.js, Open Redirect, Vulnerability Chaining, SEO PoisoningAbstract
This case study presents a forensically documented analysis of a multi-stage security incident involving CVE-2024-4367, an arbitrary JavaScript execution vulnerability in PDF.js. The incident occurred on one PKP Open Journal Systems (OJS) deployment. The observed chain involved an open redirect in the host platform's sign-out handler (CWE-601), a prefix-match URL validation weakness in the PDF.js viewer wrapper, and PDF.js font parsing behavior associated with CVE-2024-4367. The evidence demonstrates execution of attacker-controlled JavaScript in the viewer context and an SEO-poisoning effect; it does not establish a general vulnerability in all OJS, WordPress, Drupal, or enterprise deployments. CVSS scores are reported separately for the identified CVE and are not combined into a fabricated composite score. A defense-in-depth mitigation strategy combining reverse-proxy rules, library patches, and Content Security Policy was deployed and verified.
References
Barth, A. (2011). The Web Origin Concept. In RFC 6454. Internet Engineering Task Force. https://doi.org/10.17487/rfc6454
Berners-Lee, T., Fielding, R., & Masinter, L. (2005). Uniform Resource Identifier (URI): Generic Syntax. In RFC 3986. Internet Engineering Task Force. https://doi.org/10.17487/rfc3986
Chen, Y., Wang, S., She, D., & Jana, S. (2020). On Training Robust PDF Malware Classifiers. 29th USENIX Security Symposium (USENIX Security 20), 2343–2360. https://www.usenix.org/conference/usenixsecurity20/presentation/chen-yizheng
Exfil0. (2024). WEAPONIZING-CVE-2024-4367. In GitHub repository. https://github.com/exfil0/WEAPONIZING-CVE-2024-4367
Lekies, S., Stock, B., & Johns, M. (2013). 25 Million Flows Later. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security - CCS ’13, 1193–1204. https://doi.org/10.1145/2508859.2516703
Liu, S., Ming, J., Zhou, Y., Fu, J., & Peng, G. (2025). VAPD: An Anomaly Detection Model for PDF Malware Forensics with Adversarial Robustness. 34th USENIX Security Symposium (USENIX Security 25), 4759–4778. https://www.usenix.org/conference/usenixsecurity25/presentation/liu-side
MITRE. (2023a). MITRE ATT&CK. In MITRE ATT&CK. https://attack.mitre.org/
MITRE. (2023b). T1189: Drive-by Compromise. In MITRE ATT&CK. https://attack.mitre.org/techniques/T1189/
MITRE. (2023c). T1203: Exploitation for Client Execution. In MITRE ATT&CK. https://attack.mitre.org/techniques/T1203/
MITRE. (2024a). CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). In Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/79.html
MITRE. (2024b). CWE-345: Insufficient Verification of Data Authenticity. In Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/345.html
MITRE. (2024c). CWE-601: URL Redirection to Untrusted Site (Open Redirect). In Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/601.html
Mozilla. (2024). Arbitrary JavaScript Execution upon Opening a Malicious PDF with PDF.js. In GitHub Security Advisory GHSA-wgrm-67xf-hhpq. https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
npm. (2024). pdfjs-dist: Generic Build of Mozilla’s PDF.js Library. In npm Registry. https://www.npmjs.com/package/pdfjs-dist
OWASP Foundation. (2024a). Content Security Policy (CSP) Cheat Sheet. In OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
OWASP Foundation. (2024b). Cross Site Scripting Prevention Cheat Sheet. In OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
OWASP Foundation. (2024c). Unvalidated Redirects and Forwards Cheat Sheet. In OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
Public Knowledge Project. (2023). PDF.js Viewer Plugin for Open Journal Systems. In GitHub Repository. https://github.com/pkp/pdfJsViewer
Public Knowledge Project. (2024). Security Advisories. In GitHub Security Advisories. https://github.com/pkp/pkp-lib/security
Public Knowledge Project. (2025). Open Journal Systems. In Public Knowledge Project. https://pkp.sfu.ca/software/ojs/
Runeson, P., Höst, M., Rainer, A., & Regnell, B. (2012). Case Study Research in Software Engineering. Wiley. https://doi.org/10.1002/9781118181034
Squarcina, M., Tempesta, M., Veronese, L., Calzavara, S., & Maffei, M. (2021). Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web. 30th USENIX Security Symposium (USENIX Security 21), 2917–2934. https://www.usenix.org/conference/usenixsecurity21/presentation/squarcina
National Institute of Standards and Technology. (2024). CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js. In National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2024-4367
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Muhammad Hendra Sunarya, M. Nanda Dede Nugroho, Reja Revaldy F, Ryan Rizky Pratama
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Authors who publish with this journal agree to the following terms as stated in http://creativecommons.org/licenses/by-nc/4.0
a. Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
b. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
c. Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work.
