CVE-2024-28109: veraPDF has potential XSLT injection vulnerability when using policy files
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.81239%
CWE
Published
5/20/2024
Updated
1/17/2025
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.verapdf:core | maven | < 1.24.2 | 1.24.2 |
| org.verapdf:core-jakarta | maven | < 1.24.2 | 1.24.2 |
| org.verapdf:core-arlington | maven | < 1.25.127 | 1.25.127 |
| org.verapdf:verapdf-library-arlington | maven | < 1.25.127 | 1.25.127 |
| org.verapdf:verapdf-library | maven | < 1.24.2 | 1.24.2 |
| org.verapdf:verapdf-library-jakarta | maven | < 1.24.2 | 1.24.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insecure XSLT processing configurations in multiple classes. Key indicators:
- All affected files used TransformerFactory without FEATURE_SECURE_PROCESSING and ACCESS_EXTERNAL_STYLESHEET restrictions
- The patches explicitly add these security features in static initializers
- The commit message confirms 'Set secure parameter for xslt transformation'
- CWE-91 directly maps to XML/XSLT injection scenarios
- The vulnerability manifests when processing user-supplied policy files through these transformation functions High confidence because:
- The pre-patch code clearly lacks security features shown in the diffs
- The CVE description explicitly links XSLT processing to RCE
- Multiple classes with XSLT handling were simultaneously patched