CVE-2024-28109: veraPDF XSLT injection in policy files

Executive brief

veraPDF is an open-source library used to validate PDF files against archival standards. A security vulnerability exists when the software processes custom policy files, which could allow an attacker to execute unauthorized commands on the system. This risk primarily affects organizations using specialized, custom validation rules rather than the standard default settings. Exploitation could lead to a full system compromise or unauthorized access to sensitive data.

Technical details

A vulnerability classified as XML Injection (CWE-91) exists in veraPDF's policy enforcement engine. When executing policy checks using custom Schematron files, the application invokes an XSL transformation that does not properly neutralize malicious inputs. An attacker with the ability to provide or influence a custom policy file can inject malicious XSLT code. This can theoretically lead to Remote Code Execution (RCE) or unauthorized data access. The vulnerability is patched in versions 1.24.2 (standard) and 1.25.127 (Arlington). Standard validation using default profiles is not affected.

Affected products

• veraPDF core < 1.24.2
• veraPDF core-jakarta < 1.24.2
• veraPDF library < 1.24.2
• veraPDF library-jakarta < 1.24.2
• veraPDF verapdf-library < 1.24.2
• veraPDF verapdf-library-jakarta < 1.24.2
• veraPDF core-arlington < 1.25.127
• veraPDF library-arlington < 1.25.127
• veraPDF verapdf-library-arlington < 1.25.127

Timeline

• 2024-03-28: advisory: NVD and GitHub initial publication
• 2024-05-20: disclosed: GitHub Advisory reviewed and published

References

• https://api.github.com/users/binary-1024
• https://github.com/binary-1024
• https://api.github.com/users/binary-1024/gists%7B/gist_id%7D
• https://api.github.com/users/binary-1024/repos
• https://avatars.githubusercontent.com/u/126555726?v=4
• https://api.github.com/users/binary-1024/events%7B/privacy%7D