veraPDF-validation XXE Vulnerability Advisory (CVE-2024-5402)

Vulnerability Overview Vulnerability Name: Use of Default leads to XXE When Processing Untrusted PDFs Description: veraPDF-validation contains an XML External Entity (XXE) vulnerability present in two PDF parsing paths ( and ). Maliciously crafted PDF files can be provided to veraPDF consumers, causing external entities to be expanded during parsing. This allows for local file disclosure and potential outbound network requests, depending on the runtime (host) environment. Affected Versions Affected Versions: - : >= 1.17.35, = 1.17.35, <= 1.30.1 Remediation Fixed Versions: - : 1.30.2 - : 1.31.71 Additional Details Summary: - veraPDF-validation contains an XML External Entity (XXE) vulnerability present in two PDF parsing paths ( and ). Maliciously crafted PDF files can be provided to veraPDF consumers, causing external entities to be expanded during parsing. This allows for local file disclosure and potential outbound network requests, depending on the runtime (host) environment. Details: - Consumers processing untrusted PDF files using the or APIs are vulnerable to XXE attacks. - Both vulnerable paths share the same root cause: the underlying source code binds to the default and immediately calls , which does not disable the parsing of DTDs, external entities, XInclude, or external resource access instructions. - This is an XXE vulnerability affecting the use of affected veraPDF APIs to parse or validate untrusted PDF files. - An attacker can create a PDF containing malicious XML external entities that may be parsed by the validator during processing, leading to local file disclosure and outbound network requests to attacker-controlled endpoints, depending on JVM XML parser behavior and network controls on the host. Other Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None CVSS v3 Base Score: 6.5 / 10 CVE ID: CVE-2024-5402 Weakness: No CWEs Credit: acornill (Reporter)

Goal Reached Thanks to every supporter — we hit 100%!

veraPDF-validation XXE Vulnerability Advisory (CVE-2024-5402)

More from this source