Actions 2.0 in PDF

• Launch: nothing happens, seems to be disabled
• URI
  • URI: usage of a /URI to jump to Google
  • URI with param: usage of a /URI to jump to Google passing arguments
• SubmitForm:
  • SubmitForm (GET+PDF): blocked by the plugin stating this should be done directly in Acrobat, not in a plug-in.

    The document needs to be opened inside the Acrobat window (as opposed
    to the web browser) in order to submit this form
        

  • SubmitForm (GET+HTML): same as previous
  • SubmitForm (GET+HTML+PARAM): same as previous
  • SubmitForm (POST+PDF): based on an invisible form with no field submitted to Google

  POST / HTTP/1.1
  Host: google.fr
  User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
  Referer: http://batman/raynal/samples/actions/submitform/submitform-post-pdf-google.pdf
  Cookie: NID=22=hZSHGhZF...4rtF;
  Content-Type: application/vnd.fdf
  Content-Length: 264
  Referer: http://batman/raynal/samples/actions/submitform/submitform-post-pdf-google.pdf
  Acrobat-Version: 9.1.1
  
  %FDF-1.2
  %....
  1 0 obj
  <<
      /FDF
          <<
              /F(http://batman/raynal/samples/actions/submitform/submitform-post-pdf-google.pdf)
              /ID[<><>]
              /UF(http://batman/raynal/samples/actions/submitform/submitform-post-pdf-google.pdf)
          >>
      /Type/Catalog
  >>
  endobj
  trailer
  <</Root 1 0 R>>
  %%EOF
  
  
  HTTP/1.1 405 Method Not Allowed
      

  • SubmitForm (POST+HTML): same as previous, but with Content-Length: 0

    POST / HTTP/1.1
    Host: google.fr
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
    Referer: http://batman/raynal/samples/actions/submitform/submitform-post-html-google.pdf
    Cookie: PREF=ID=560... NID=23=BlA...-yo
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 0
    Referer: http://batman/raynal/samples/actions/submitform/submitform-post-html-google.pdf
    Acrobat-Version: 9.1.1
    
    
    HTTP/1.1 405 Method Not Allowed
    

  • SubmitForm (POST+HTML+PARAM): same as previous, params are passed in the request like a GET.
• GoToR
  • GoToR same origin: no path/url is given, but tries to jump to base.pdf. If it is also at the same location on the server, it is opened.
  • GoToR another origin: a full URL to another PDF is given, on a remote server.
  • GoToR another origin, another kind: a full URL to jump to Google with a GET.

    GET / HTTP/1.1
    Host: google.fr
    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.9) Gecko/2009050519 Iceweasel/3.0.9 (Debian-3.0.9-1)
    Cookie: NID=22=hZSHGhZF...4rtF;
    
    
    HTTP/1.1 301 Moved Permanently
    Location: http://www.google.fr/
    

  • GoToR another origin, another kind, query: a full URL to jump to Google with a GET, performing a query.
  • GoToR another origin, another kind, query, new window: same as previous, requesting opening in a new windows ... which is not opened.
  • webping and webpong: 2 files jumping to each other.

A few word of Adobe's JavaScript

• doc.submitForm is the same as native /SubmitForm
• app.lauchURL behaves like GoToR
• lame infoleaks: very few info thanks to JavaScript.
  • Some like app.URL or app.path access domain file:// => multiple domains are reached => alert pop-up
  • Use an action /SubmitForm but can be done fully with JavaScript with this.submitForm()
• Communication channels:
  • msgHandler(web -> pdf): send messages from the web page to the displayed PDF.

Playings with parameters

• inexistant parameter
• FDF: used to specify some more data to the PDF files:
  • add JS
  • /F a: redirects to another place