Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.verapdf:validation-model | maven | >= 1.25.73, <= 1.30.1 | 1.30.2 |
| org.verapdf:validation-model | maven | >= 1.31.1, <= 1.31.70 | 1.31.71 |
| org.verapdf:validation-model-jakarta | maven | >= 1.25.73, <= 1.30.1 | 1.30.2 |
| org.verapdf:validation-model-jakarta | maven | >= 1.31.1, <= 1.31.70 | 1.31.71 |
Miggo AIRoot Cause AnalysisThe vulnerability is an XML External Entity (XXE) injection (CWE-611) in the veraPDF validation library. The root cause is the use of a default javax.xml.parsers.DocumentBuilderFactory to parse XML from PDF files without disabling features that resolve external entities. An attacker can craft a malicious PDF containing a rich-text entry or XFA data with a DOCTYPE declaration pointing to an external DTD. When the veraPDF validator parses this PDF, the XML parser resolves the external entity, allowing the attacker to read arbitrary files from the server's filesystem or perform Server-Side Request Forgery (SSRF) attacks.
The patch, found in commit cacd9436d0de40b0e58cc7d2dbb06451619e61ec, addresses this by replacing the insecure DocumentBuilderFactory.newInstance() with a centralized, secure method SecureXML.newSafeDocumentBuilder(). This new method presumably configures the XML parser to disable external entity resolution, following security best practices.
Two functions were identified as vulnerable based on the patch:
org.verapdf.gf.model.tools.DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation: This function, explicitly mentioned in the advisory, was responsible for parsing rich-text entries and was a direct vector for the XXE attack.org.verapdf.gf.model.impl.pd.GFPDAcroForm.getdynamicRender: This function was also patched to use the secure document builder. It handles dynamic rendering of forms using XFA, which is XML-based, and thus presented another vector for the same XXE vulnerability.org.verapdf.gf.model.tools.DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentationvalidation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java
org.verapdf.gf.model.impl.pd.GFPDAcroForm.getdynamicRendervalidation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java