CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI
Attackers can achieve remote code execution via XXE in veraPDF CLI when processing untrusted custom Schematron files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-52800?
CVE-2024-52800 is a low-severity vulnerability in veraPDF-library, published on 29 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.
Weakness: CWE-611
Which versions are affected by CVE-2024-52800?
18 open source packages ship an affected version, including org.verapdf:verapdf-library, org.verapdf:core and org.verapdf:core-arlington.
| Package | Affected | Fixed in |
|---|---|---|
org.verapdf:verapdf-library Maven | All versions | 1.26.2 |
org.verapdf:verapdf-library Maven | All versions | 1.26.2 |
org.verapdf:core Maven | All versions | 1.26.2 |
org.verapdf:core Maven | All versions | 1.26.2 |
org.verapdf:core-arlington Maven | All versions | 1.26.2 |
org.verapdf:core-arlington Maven | All versions | 1.26.2 |
12 more packages
org.verapdf:core-jakarta Maven | All versions | 1.26.2 |
org.verapdf:core-jakarta Maven | All versions | 1.26.2 |
org.verapdf:library Maven | All versions | 1.26.2 |
org.verapdf:library Maven | All versions | 1.26.2 |
org.verapdf:library-arlington Maven | All versions | 1.26.2 |
org.verapdf:library-arlington Maven | All versions | 1.26.2 |
org.verapdf:library-jakarta Maven | All versions | 1.26.2 |
org.verapdf:library-jakarta Maven | All versions | 1.26.2 |
org.verapdf:verapdf-library-arlington Maven | All versions | 1.26.2 |
org.verapdf:verapdf-library-arlington Maven | All versions | 1.26.2 |
org.verapdf:verapdf-library-jakarta Maven | All versions | 1.26.2 |
org.verapdf:verapdf-library-jakarta Maven | All versions | 1.26.2 |
How do I fix CVE-2024-52800?
Upgrade org.verapdf:verapdf-library to 1.26.2 or later.
Is CVE-2024-52800 being exploited?
There is no known exploitation of CVE-2024-52800 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-4cx5-89vm-833x.