Talks

Upcoming

Black Hat Europe Locknote: Conclusions and Key Takeaways

Researcher: James Kettle

Conferences

Black Hat Europe 2020, 10 Dec 2020, 15:20 UTC

Join members of the Black Hat Review Board for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways from day one and how these trends will impact future InfoSec strategies.

Portable Data exFiltration: XSS for PDFs

Researcher: Gareth Heyes

Conferences

Black Hat Europe 2020, 10 Dec 2020, 12:30 UTC

PDF documents and PDF generators are ubiquitous on the web, and so are injection vulnerabilities. Did you know that controlling a measly HTTP hyperlink can provide a foothold into the inner workings of a PDF? In this session, you will learn how to use a single link to compromise the contents of a PDF and exfiltrate it to a remote server, just like a blind XSS attack.

I'll show how you can inject PDF code to escape objects, hijack links, and even execute arbitrary JavaScript - basically XSS within the bounds of a PDF document. I evaluate several popular PDF libraries for injection attacks, as well as the most common readers: Acrobat and Chrome's PDFium. You'll learn how to create the 'alert(1)' of PDF injection and how to improve it to inject JavaScript that can steal the contents of a PDF on both readers.

I'll share how I was able to enumerate the various PDF objects to discover functions that make external requests using a custom JavaScript enumerator, which enable you to exfiltrate data from the PDF. Even PDFs loaded from the filesystem in Acrobat, which have more rigorous protection, can still be made to make external requests. I've successfully crafted an injection that can perform a SSRF attack on a PDF rendered server-side. I've also managed to read the contents of files from the same domain, even when the Acrobat user agent is blocked by a WAF. Finally, I'll show you how to steal the contents of a PDF without user interaction, and wrap up with a hybrid PDF that works on both PDFium and Acrobat.

Previous