CVE-2024-34342

What it actually does

The flaw allows JavaScript embedded or triggered through a malicious PDF to execute in the browser context of the application that renders the PDF. When react-pdf/PDF.js processes attacker-controlled PDF content with PDF.js `isEvalSupported` enabled, which is the default, the attacker can break out of the intended PDF rendering boundary and run script as if it came from the hosting web application. This can expose same-origin data, session tokens accessible to JavaScript, application state, and allow unauthorized actions through the victim user's authenticated browser session. The issue requires a user or application workflow to load a malicious PDF, so exploitation is user-interaction dependent, but successful exploitation has high confidentiality and integrity impact.

Why it matters to the business

Applications that allow users to view uploaded, shared, emailed, or externally supplied PDFs can become a vehicle for account compromise, data theft, fraudulent transactions, or unauthorized changes inside the affected web application. The risk is highest for portals that handle sensitive documents, authenticated business workflows, customer data, financial records, healthcare records, or administrative functions. Although this is not currently listed in CISA KEV and the provided EPSS score is low, the issue has been public for a long time and affects a common PDF-rendering pattern in React applications, so vulnerable deployments should be treated as a meaningful web application exposure rather than a theoretical library bug.

How an attack unfolds

An attacker first identifies a web application that renders PDFs using a vulnerable react-pdf/PDF.js stack and permits a victim to open attacker-supplied PDF content, such as an upload, shared document, support attachment, invoice, report, or link. The attacker crafts a PDF that causes PDF.js to evaluate attacker-controlled JavaScript while rendering the document. When a victim opens the PDF in the affected application, PDF.js processes the malicious content with `isEvalSupported` set to `true`. The browser then executes the attacker's script in the origin of the hosting application. From there, the attacker can read data available to the page, interact with application APIs using the victim's session, modify displayed content, exfiltrate tokens or sensitive page data if accessible to JavaScript, or stage further phishing and session-abuse actions.

How to fix it

Upgrade affected PDF rendering dependencies. For react-pdf, use fixed versions 7.7.3 or 8.0.2 or later, depending on the major release line in use. For direct PDF.js consumers from Git, ensure the codebase includes the fixed commit `85e64b5c16c9aaef738f421733c12911a441cec6` or a later safe revision. Also review transitive dependencies such as `pdfjs-dist` and ensure lockfiles have been regenerated so the deployed artifact actually contains the patched code. As defense in depth, explicitly configure PDF.js with `isEvalSupported: false` wherever PDF rendering is performed unless there is a verified business requirement for eval support. Deploy a restrictive Content Security Policy that avoids `unsafe-eval` and limits script destinations, recognizing that CSP is a mitigation and not a substitute for patching. Treat user-supplied PDFs as untrusted content: scan or sanitize uploads where feasible, restrict who can upload PDFs, and consider rendering untrusted PDFs in a sandboxed, isolated origin or iframe with minimal privileges.

How to confirm the fix worked

Confirm dependency versions in source, build artifacts, and deployed containers. For Node/React applications, run dependency checks such as `npm ls react-pdf pdfjs-dist`, `yarn why react-pdf pdfjs-dist`, or equivalent software composition analysis and verify react-pdf is 7.7.3, 8.0.2, or later. If consuming PDF.js directly from Git, verify the deployed revision includes commit `85e64b5c16c9aaef738f421733c12911a441cec6` or a later commit. Search application code and built bundles for `isEvalSupported` and confirm it is explicitly set to `false` for PDF rendering paths. Validate the browser response headers include a CSP that does not allow `unsafe-eval` unless there is a documented exception. Functionally test by opening representative PDFs in the application after the upgrade and confirming rendering still works. If using vulnerability scanners or SCA tools, re-run scans against the final deployed artifact, not only the source repository, to ensure lockfiles and packaged assets were updated.

Typical attack path

1. Find an application feature that previews or renders PDFs using vulnerable react-pdf/PDF.js versions.
2. Confirm that the PDF.js configuration leaves `isEvalSupported` enabled or does not explicitly disable JavaScript evaluation.
3. Create a malicious PDF designed to trigger JavaScript execution during PDF.js parsing or rendering.
4. Deliver the PDF through an upload, shared document, email attachment, ticket attachment, messaging workflow, or link that will be opened in the target application.
5. Wait for an authenticated user to open or preview the PDF in the affected application.
6. Execute attacker-controlled JavaScript in the hosting application's browser origin.
7. Use the victim's browser context to read accessible data, call same-origin APIs, alter application content, or exfiltrate sensitive information.

How to detect it

There is no single universal network or file indicator for exploitation because the payload is contained in attacker-supplied PDF content and execution occurs in the victim's browser. Investigations should correlate document access with subsequent suspicious browser activity. Review application upload logs, document access logs, CDN/WAF/proxy logs, and web server logs for recently uploaded or externally sourced PDFs that were opened by privileged or sensitive users. Look for PDF files followed closely by unusual same-origin API calls, unexpected account or data changes, abnormal export/download activity, or requests to unfamiliar external domains from the affected application page. Review browser security telemetry and CSP reports for eval-related violations or blocked outbound connections originating from pages that render PDFs. Examine EDR/browser telemetry for suspicious script execution patterns in browser processes, unusual clipboard or storage access, or unexpected network beacons immediately after PDF previews. If server-side file retention is available, preserve and analyze suspicious PDFs for embedded JavaScript, unusual objects, launch/action annotations, obfuscated streams, or references to external URLs. Also search code repositories and deployed bundles for exposure indicators such as vulnerable react-pdf/PDF.js versions and `isEvalSupported` being left enabled.

• isEvalSupported: true
• isEvalSupported=true
• "isEvalSupported":true
• isEvalSupported:!0
• isEvalSupported=!0
• node_modules/react-pdf/
• node_modules/pdfjs-dist/
• pdfjs-dist/build/pdf.worker
• pdf.worker.js
• react-pdf
• pdfjs-dist
• unsafe-eval
• Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script
• Content Security Policy directive: "script-src"
• /pdf.worker.js
• /pdf.worker.min.js

What your security team should do

• Inventory all applications and services that render PDFs in-browser using react-pdf, PDF.js, or `pdfjs-dist`, including internal portals and document-management workflows.
• Prioritize remediation for applications where untrusted or externally supplied PDFs can be uploaded, shared, previewed, or opened by authenticated users.
• Upgrade react-pdf to 7.7.3, 8.0.2, or later, and verify direct PDF.js consumers include fixed commit `85e64b5c16c9aaef738f421733c12911a441cec6` or later.
• Explicitly set PDF.js `isEvalSupported` to `false` in all PDF rendering code paths unless a justified exception is approved.
• Review Content Security Policy and remove `unsafe-eval` from affected applications where feasible.
• Search historical application, web, proxy, CDN, EDR, and browser telemetry for suspicious PDF access followed by unusual same-origin API calls, unexpected outbound requests, or CSP eval violations.
• Add regression tests or SCA policy gates to prevent reintroduction of vulnerable react-pdf/PDF.js versions or unsafe PDF.js eval configuration.
• For high-risk applications, isolate untrusted PDF rendering into a sandboxed iframe or separate origin with reduced access to authentication tokens and application APIs.