New Injection Technique Exfiltrates Sensitive Data in PDF Files

Summary

PDF files are widely used for document sharing among businesses and may contain sensitive information. A new code-injection technique was discovered that allows threat actors to inject code and exfiltrate data as in classic cross-site scripting (XSS) attacks, and with capabilities of escaping objects such as parentheses and backslashes, hijacking links, and executing arbitrary JavaScript inside PDF files. The two popular libraries vulnerable to exploitation are PDF-Lib and jsPDF.

Recommendations

The NJCCIC recommends developers escape parentheses and backslashes when accepting users input within text streams or annotation URIs and perform validation on any content going into PDFs to ensure PDF code cannot be injected. We advise users to exercise caution when clicking on links or attachments and verify the legitimacy of requests via a separate means of communication. Further technical details, whitepaper, and presentation can be found in the PortSwigger article.