## https://sploitus.com/exploit?id=2750BB68-0A18-5845-ABD6-5A1FA81BF5C7
[!IMPORTANT]
This repository is designed for learning about vulnerabilities. Please only perform this hands-on exercise on the appropriate computers under your management. Do not engage in any illegal activities. The author will not assume any responsibility for any damages or issues arising from using this repository. #CVE-2024-4367-hands-on
### Creating a poc.pdf file
```bash
python CVE-2024-4367-PoC/CVE-2024-4367.py "alert('document.domain')"
```
Reference: https://github.com/LOURC0D3/CVE-2024-4367-PoC
A poc.pdf file will be created. For detailed instructions, refer to the following link: https://github.com/LOURC0D3/CVE-2024-4367-PoC
### Running vulnerable Firefox and testing the attack
```bash
python firefox.py 125
```
Use a vulnerable version of Firefox Nightly to open the poc.pdf file. The first run may take some time as it requires downloading Firefox Nightly. Ensure that JavaScript is enabled and that an alert is displayed.
### Testing with a Firefox version that has been patched
```bash
python firefox.py 135
```
Open the poc.pdf file in the new version of Firefox Nightly. Ensure that no alerts are displayed, indicating that the vulnerability has been fixed.
### Comparing the source code of PDF.js
There are two versions of the PDF.js library: one containing the vulnerability ([vulnerable-pdf.js]) and another with the vulnerability fixed ([invulnerable-pdf.js]). The [pdfjs_diff_font_renderer.js] file contains the diff between the two versions.