PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Portable Data exFiltration: XSS for PDFs

portswigger.net | research | #xss | #ssrf | #pdf | #data-exfiltration | #pdfium | #acrobat
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.
Published
Collected

Related coverage

research · portswigger.net
Fickle PDFs: exploiting browser rendering discrepancies
Fickle PDFs abuse widget annotations to render differently per browser — the same invoice shows £399 in Safari but £999 in Chrome — enabling fraud. Code to build hybrid PDFs with PDFBox included.
research · swarm.ptsecurity.com
Blind trust: what is hidden behind the process of creating your PDF file?
PT SWARM analyzed seven HTML-to-PDF libraries including TCPDF, mPDF, dompdf and jsPDF, finding 13 vulnerabilities plus risky defaults enabling SSRF, data leaks and DoS, with threat model and PoCs.
research · projectblack.io
Preventing Downloads from Unmanaged Devices in O365
Defender for Cloud Apps' download blocking is bypassable with magic user-agent strings; the post demonstrates the bypass and recommends native download restrictions in Outlook and SharePoint.
research · projectblack.io
Security Risks of Setting Access Control Allow Origin: *
When wildcard CORS turns dangerous: with cookie auth, SameSite=None, credentials enabled, and a reflected origin, malicious sites can read authenticated responses. Fixes include SameSite Lax/Strict.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
Back