alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Firefox ESR PDF.js Arbitrary Javascript Execution (CVE-2024-4367)"; flow:established,to_client; file.data; content:"|25|PDF|2d|"; startswith; content:"|2f|FontMatrix|20 5d|"; fast_pattern; pcre:"/^[^7d]*?\x3b/R"; reference:url,www.exploit-db.com/exploits/52273; reference:cve,2024-4367; classtype:misc-attack; sid:2062514; rev:1; metadata:affected_product Firefox, attack_target Client_Endpoint, created_at 2025_05_22, cve CVE_2024_4367, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_22; target:dest_ip;)