veraPDF Validation XXE Vulnerability: Early Warning
An XML External Entity Injection vulnerability in veraPDF-validation is under investigation. It reportedly allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream.
What happened
The vulnerability, tracked as GHSA-36mm-w85j-3q2j and GHSA-3jh7-wm29-q568, affects the verapdf-validation component available via maven. The issue arises from improper handling of XML External Entity references in PDFs processed by veraPDF. This could potentially allow an attacker to read sensitive files on the server or perform Server-Side Request Forgery attacks.
Professional software engineers using veraPDF-validation in their projects should assess their exposure to this vulnerability. The recommended action is to upgrade to a patched version of veraPDF-validation once it becomes available. Further details on the affected versions and the patch release date are currently under investigation. Consult the primary sources for the most up-to-date information.
How 0Day mitigates this
verapdf-validation is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.