XML External Entity (XXE) Vulnerability in libpdfbox-java: Apache PDFBox Versions Prior to 1.8.12 and 2.x Before 2.0.1
Summary
DEBIAN-CVE-2016-2175: Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF. Affects libpdfbox-java versions < 1:1.8.12-1. Fixed in 1:1.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpdfbox-java is a Java library used for creating and manipulating PDF documents. It provides functionalities such as text extraction, PDF generation, and rendering. The library is widely utilized in applications that require PDF processing. However, certain versions of libpdfbox-java are vulnerable to an XML External Entity (XXE) attack, which can compromise the security of applications using this library.
Vulnerability Detail
The vulnerability arises from improper initialization of XML parsers in Apache PDFBox versions before 1.8.12 and 2.x before 2.0.1. This flaw allows context-dependent attackers to exploit the library by crafting malicious PDF files that can trigger XXE attacks. Such attacks can lead to unauthorized access to sensitive data, denial of service, or even remote code execution, depending on the application's environment and configuration.
How To Fix
Minimum fixed version
1:1.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpdfbox-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted PDF files or ensure that XML parsing is disabled in the application configuration until the package is updated.
Conclusion
The libpdfbox-java library has a critical vulnerability that can lead to severe security issues if not addressed. Users are strongly encouraged to update to the latest patched version to protect their applications from potential attacks.
See every vulnerability recorded for libpdfbox-java →
FAQ
An XXE attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data. It can lead to the disclosure of confidential data, server-side request forgery, and other security issues.
The vulnerability affects Apache PDFBox versions prior to 1.8.12 and 2.x versions before 2.0.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include unauthorized access to sensitive information, denial of service, and potential remote code execution, depending on the application's configuration.
Yes, you can mitigate the risk by avoiding the processing of untrusted PDF files and disabling XML parsing in your application until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox-java.
