FINDING ID: iSEC-WMF1214-14

TARGETS: The upload feature, available at http://devwiki/wiki/Special:Upload .

DESCRIPTION: The PDF format allows for documents containing embedded JavaScript. During testing,
a PDF that executes JavaScript when the document is opened was successfully uploaded.
Testing indicated that this feature only works in Adobe Reader, whereas other readers such as the PDF
reader built into Firefox and the PDF reader built into Chrome do not support JavaScript actions.
JavaScript could be used to de-anonymize a user or to attempt exploits against a user. PDF readers
execute embedded JavaScript in a sandboxed context that should not have any ability to access data
from the wiki domain.

EXPLOIT SCENARIO: An attacker wishes to determine who reads a specific wiki article. The attacker
creates a PDF that uses JavaScript to make surreptitious HTTP requests to an attacker-controlled server,
using an existing PDF document related to the article as a base. A user interested in the topic opens
the PDF for more information while reading the article and their PDF reader sends a request to the
attacker, revealing their IP address, and by extension, their location.

SHORT TERM SOLUTION: Provide a click-through warning informing users that PDF documents are
active content that could potentially de-anonymize them when viewed directly.

LONG TERM SOLUTION: Convert uploaded PDFs to static images to avoid issues with active content.
Ensure the library used for conversion is robust as it will be parsing potentially malicious content on
the server side, which could be a greater compromise than individual users. Consider setting up a
sandboxed environment.