PatchGap
Firefox · Toolkit

CVE-2024-9393

Cross Origin in Toolkit
High firefox Cross Origin 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions.
ComponentToolkit
Bug ClassCross Origin
Tracker1918301
Fix commit866a4943cb8c (firefox) +7/-0
CISA KEVNot listed
CreditedMasato Kinugawa
Disclosed2024-10-01

Changed Functions

FunctionChangeNotes
getConvertedType
toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs
 modified
if
toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs
 modified

Files Changed

  • toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs

Patch

view commit
diff --git a/toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs b/toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs
index 2c85c1ae25d..bf64528d51f 100644
--- a/toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs
+++ b/toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs
@@ -1018,6 +1018,13 @@ PdfStreamConverter.prototype = {
   },
 
   getConvertedType(aFromType, aChannel) {
+    if (aChannel instanceof Ci.nsIMultiPartChannel) {
+      throw new Components.Exception(
+        "PDF.js doesn't support multipart responses.",
+        Cr.NS_ERROR_NOT_IMPLEMENTED
+      );
+    }
+
     const HTML = "text/html";
     let channelURI = aChannel?.URI;
     // We can be invoked for application/octet-stream; check if we want the
Loading diff…
On This Page