Detect CVE-2024-4367

Quick-and-dirty YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js.

Usage

$ yara expl_pdfjs_cve_2024_4367.yar poc_generalized_CVE-2024-4367.pdf
EXPL_PDFJS_CVE_2024_4367 poc_generalized_CVE-2024-4367.pdf

Credits

POC and disclosure from https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/.