Affected versions

This vulnerability affects all ZK versions from 9.0.0 to current latest 10.0.0

Steps to Reproduce

display the attached sample in a pdfviewer (pdf attached is a blank sample, with an alert JS inserted in the font declaration)
NOTE: This alert may not appear, a JS error instead indicates an attempted execution, which is still proof of the vulnerability

Current Result

JS error trying to run JS from reproducing PDF

Expected Result

PDF cannot run arbitrary code

Debug Information

• Disable PDF JS evaluation using PDF.js isEvalSupported:false
• https://nvd.nist.gov/vuln/detail/CVE-2024-4367

Workaround

Deploy in zul, or globally through lang-addon

<script><![CDATA[ 
	zk.afterLoad("zkex.pdfviewer", function () {
	    var _xPdfviewer = {};
	    zk.override(zkex.pdfviewer.Pdfviewer.prototype, _xPdfviewer, {
	    	_loadPdf: function _loadPdf(src) {
	    		var source = {url: src, isEvalSupported: false};
	    		return _xPdfviewer._loadPdf.apply(this, [source]);
	 	}
	     });
	});
]]></script>