Universal XSS in Adobe PDF Browser Plugin

Stephan Esser just posted about a potentially universal XSS in Adobe's PDF plugin first mentioned here. All it requires is appending "#something=javascript:<insert script here>;" to the end of the link and Adobe PDF will happily execute the JavaScript.

For example.

You should probably disable Adobe's PDF plugin in the meantime. If you don't think XSS attacks are particularly interesting, check out what you can do with XSSProxy.

Posted by Dominic White