Log in Start free

Vulnerability · Published Nov 29, 2024 · Assigned by GitHub_M

CVE-2024-52800Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

Low 2.3

In plain English

A low-severity XML external entity in veraPDF-library from veraPDF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.verapdf:core1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:core-arlington1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:core-jakarta1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:library1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:library-arlington1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:library-jakarta1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:verapdf-library1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:verapdf-library-arlington1.26.2GHSA-4cx5-89vm-833x
Mavenorg.verapdf:verapdf-library-jakarta1.26.2GHSA-4cx5-89vm-833x

Affected products (as reported)

VendorProductVersions
veraPDF veraPDF-library <= 1.26.1

Weakness: CWE-611 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References