GHSA-4cx5-89vm-833x: veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-52800

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

Low severity GitHub Reviewed Published Nov 29, 2024 in veraPDF/veraPDF-library • Updated Dec 2, 2024

Package

maven org.verapdf:core (Maven)

Affected versions

<= 1.26.1

maven org.verapdf:core-arlington (Maven)

maven org.verapdf:core-jakarta (Maven)

maven org.verapdf:verapdf-library-arlington (Maven)

maven org.verapdf:verapdf-library-jakarta (Maven)

maven org.verapdf:verapdf.library (Maven)

Impact

Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.

Patches

We are currently working on a patch that will be released when ready.

Workarounds

This doesn’t affect the standard validation and policy checks functionality, veraPDF’s common use cases. Most veraPDF users don’t insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.

References

Original issue: #1488

References

• GHSA-4cx5-89vm-833x
• https://nvd.nist.gov/vuln/detail/CVE-2024-52800
• veraPDF/veraPDF-library#1488

Published to the GitHub Advisory Database

Dec 2, 2024