CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js

// Disclaimer //
Hacking without permission is illegal. This channel is strictly educational for learning about cyber-security in the areas of ethical hacking and penetration testing & bug hunting so that we can protect ourselves against the real hackers..

[@Couple-Rounds]

sending love from Kenya | GGs

[@UrduGames]

Hi pia mimi niko kenya, tunaweza connect aje

[@shareb1t]

i did not found how to generate poc pdf

[@Pal0vieeee]

I have now become a fan of yours ❤

[@lostsecc]

☺️❤️🤗

[@tomiwafalade5480]

The king is back!! 😃
Keep it up boss 🙌

[@lostsecc]

❤️

[@tomiwafalade5480]

@@lostsecc So has the bug been reported ? Tried it just now and they are still much vulerable to it

[@lostsecc]

its reported they are not patching it..

[@Hackerone1444]

Pdf script ??

[@lostsecc]

sending in telegram

[@mitulkumarpatel1288]

@@lostsecc which telegram channel?

[@lostsecc]

t.me/lostsec

[@Dh4v4l]

Nice bro I am waiting your paylod keep it up bro❤

[@lostsecc]

sure sending soon.

[@abidluthfi9444]

Where can i get the payload

[@lostsecc]

telegram

[@ArdaOzavclar]

Did you find this?

[@mohamadtaha9091]

How much does it take for you to find it?

[@lostsecc]

5min

[@mohamadtaha9091]

@@lostsecc bounty?

[@lostsecc]

dup

[@tokyorockstarVALORANT]

great find

[@gwevalentinechia8710]

please how do you know whether a particular website is having that pdf.js vulnerability

[@lostsecc]

check weplizer extension

[@gwevalentinechia8710]

@@lostsecc Thank you
Can i get a sample of the pdf you used

[@gowtham8774]

Bro can you please upload the pdf exploits payloads on your new github account?

[@lostsecc]

sure

[@gowtham8774]

​@@lostsecc Can you please upload it now? I just found a vulnerable domain, and uploading it now may help me.

[@gowtham8774]

@@lostsecc Bro please upload bro

[@MRX23816]

Muito bom 🇧🇷🇧🇷🇧🇷🇧🇷🇧🇷🇧🇷🇧🇷🇧🇷

[@aatankbadboy3941]

Loving your content❤
How much bounty you got brother 🎉

[@sneauxburrow]

Brotha eww. Always good content🔥

[@lostsecc]

🤗😇

[@sneauxburrow]

@@lostsecc you got a discord? I wanna write some tools

[@user-rg8wu2gk3d]

Sir meri Linux men nuclei install to horai but work nai kr rai.chat GPT. Bing sb sy puch Lia Mgr nai bat bni..

[@lostsecc]

dm me in telegram and send me anydesk id

[@PEGASUS007VIDA]

MY BROTHER, HOW DO I ARRANGE THE PDFS OF THIS SCRIPT, CAN YOU ADD IT FOR US?

[@lostsecc]

i am sharing in trlegram

[@egg144p]

how can i message you? My pdf xss work but not like this, your pdf payload is way more better. and i have a target and im trying to exploit it and i try your payload but there is no pop up

[@lostsecc]

maybe bcz thats not pdf.js one there arw two types of pdf exploits

[@egg144p]

@@lostsecc thanks for clarification

[@warri0rs16]

Can you make more detailed and longer videos like this.

[@lostsecc]

sure

[@kirtimanmohanty7575]

Bounty?

[@user-bn5gd9dj3o]

file upload and js injection

[@user-rg8wu2gk3d]

Error yhi araha nuclei template out dated hyn update kr Lia re install b Kia but bat ni bni

[@lostsecc]

sudo nuclei -ut

[@animospro1308]

I have xss with pdf file but i cant see the cookies i see just alertt

[@lostsecc]

i am sharing payload in telegram soon

[@animospro1308]

@@lostsecc share with me the pdf file with cookies payload i need it

[@Aks-jc3bq]

Sir , Please write all extension that you used ,which help in finding bugs and we get to know this site having vulnerability

[@amansubedi538]

first comment lots of love ❤❤

[@lostsecc]

❤️😇

[@Usmaini-ku7lq]

How leak cookie?

[@lostsecc]

must be pdf.js

[@Usmaini-ku7lq]

@@lostsecc I've searched your telegram, but there is no pdf.js with document.cookie or domain

[@akashpokemonhunter7502]

Bro how to use tor in windows terminal

[@lostsecc]

sudo apt install tor

[@akashpokemonhunter7502]

@@lostsecc bro suggest me some best programming language for scripting and for penetration testing

[@mistDexploit]

still waiting for your play list 😀💔

[@walterwhite-du4rn]

hey brother can you provide payload pdf??

[@lostsecc]

sure sending in channel

[@safisec]

ANY BOUNTY MOSTLY BBP DOESN'T ACCEPT IT. I REPORTED HUNDREDS.

[@lostsecc]

its accepted ! you need to get the cookie

[@rajdip-zm5yu]

can you please share the js files

[@lostsecc]

i shared in telegram bro

[@rajdip-zm5yu]

@@lostsecc where is your telegram link??

[@rajdip-zm5yu]

Bro, i have a question. I reported this issue on HackerOne but the report closed as an informative. Because not possible to access dom via pdf file

[@anatomygamer1129]

Can you share this pdf?

[@lostsecc]

sure

[@apple_00]

❤

[@athul2532]

tg link?

[@lostsecc]

t.me/lostsec

[@user-rg8wu2gk3d]

Please help

[@IBO.ATTACKS]

Really you are the boss

[@lostsecc]

❤️🤗

[@Jxkz-3]

Traige ?

[@lostsecc]

no response

[@MorrisDonovan]

Self-XSS. You won't get any bounty for this.

[@lostsecc]

its stored

[@MorrisDonovan]

@@lostsecc stored self-xss. Can only be used on yourself

[@MorrisDonovan]

self-stored-xss is still self-xss.

[@lostsecc]

its not self xss the HR who shortlist candidate by checking resume will affected by this..and we can get there cookie..

[@MorrisDonovan]

That's not what you demo'd. You demo'd the attacker exploiting xss on themselves.

[@uttarkhandcooltech1237]

Payload please

[@lostsecc]

telegram

[@MR_MRX1]

Bro please send all pdf files 😊❤

[@lostsecc]

sure in telegram

[@lostsecc]

soon sending

[@yahai_]

🤍😍😍

[@メメメメメメメ]

Sending Love From Pakistan 🫀😀👍
LOADING.... 99%

[@lostsecc]

❤️🫂😇🤗

[@lostsecc]

❤️🫂😇🤗

[@lostsecc]

❤️🫂😇🤗

[@メメメメメメメ]

@@lostsecc sir how did you customized your terminal and pc .. can you make a video on it ...i am a begginer in hacking ( script kiddie )..
please make it ...... sirrrrrrr..
love you 🫀🥰❤‍🩹❤‍🩹❤‍🩹❤‍🩹❤‍🩹