veraPDF Validation XXE Vulnerability: Early Warning
An XML External Entity Injection vulnerability in veraPDF-validation is under investigation. It may allow remote attackers to read files and perform Server-Side Request Forgery.
What happened
An XML External Entity Injection (XXE) vulnerability (tracked as GHSA-3JH7-WM29-Q568) has been reported in veraPDF-validation. This vulnerability, if exploited, could allow a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery (SSRF) by submitting a specially crafted PDF containing a malicious rich-text entry. The vulnerability affects all current versions of veraPDF-validation.
The recommended action is to upgrade to the latest version of veraPDF-validation that includes the proposed patch to harden the DocumentBuilderFactory. For more detailed information and to follow the status of the patch, consult the primary source at https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-3jh7-wm29-q568.
Given the severity and potential impact, it is advised that users of veraPDF-validation assess their exposure and apply the necessary updates as soon as they become available. Further details on the vulnerability and its exploitation vectors should be obtained from the primary sources.
How 0Day mitigates this
verapdf-validation is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.