Executive brief
veraPDF is an open-source tool used to validate PDF files against industry standards. A security flaw in the command-line interface (CLI) allows for a potential XML External Entity (XXE) injection when processing custom policy files. If a user is tricked into using a malicious policy file, an attacker could potentially access sensitive local files or, in theoretical scenarios, execute unauthorized code on the system.
Technical details
The veraPDF CLI contains an XML External Entity (XXE) vulnerability within the 'mergeEnabledFeaturesFromPolicy' function in 'ApplicationUtils.java'. The root cause is an insecurely configured XML parser that fails to disable external entity resolution when processing policy files (e.g., .sch, .xsl, or .xslt). An attacker can exploit this by providing a specially crafted XML policy file via the '--policyfile' argument. While the primary impact is information disclosure (XXE) and SSRF, the advisory notes that the subsequent XSL transformation could theoretically be leveraged for remote code execution (RCE). The vulnerability is patched in version 1.26.2 and 1.26.5.
Affected products
- veraPDF veraPDF-library <= 1.26.1
Timeline
- 2024-11-03: disclosed: Issue reported on GitHub
- 2024-11-29: advisory: NVD and GitHub advisory published
- 2024-12-02: other: GitHub advisory reviewed