GHSA-QXQF-2MFX-X8JW
Vulnerability from github – Published: 2024-05-20 14:57 – Updated: 2025-01-17 16:26
VLAI?
Summary
veraPDF has potential XSLT injection vulnerability when using policy files
Details
Impact
Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
This has been patched and users should upgrade to veraPDF v1.24.2
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: https://github.com/veraPDF/veraPDF-library/issues/1415
Severity ?
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core-arlington"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.127"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library-arlington"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.127"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28109"
],
"database_specific": {
"cwe_ids": [
"CWE-91"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-20T14:57:07Z",
"nvd_published_at": "2024-03-28T14:15:13Z",
"severity": "HIGH"
},
"details": "### Impact\n\nExecuting policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.\n\n### Patches\n\nThis has been patched and users should upgrade to veraPDF v1.24.2\n\n### Workarounds\n\nThis doesn\u0027t affect the standard validation and policy checks functionality, veraPDF\u0027s common use cases. Most veraPDF users don\u0027t insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.\n\n### References\n\nOriginal issue: \u003chttps://github.com/veraPDF/veraPDF-library/issues/1415\u003e\n",
"id": "GHSA-qxqf-2mfx-x8jw",
"modified": "2025-01-17T16:26:35Z",
"published": "2024-05-20T14:57:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28109"
},
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/issues/1415"
},
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb"
},
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f"
},
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe"
},
{
"type": "PACKAGE",
"url": "https://github.com/veraPDF/veraPDF-library"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "veraPDF has potential XSLT injection vulnerability when using policy files"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…