Critical XXE Vulnerabilities in veraPDF Threaten Minecraft Ecosystem Services

A significant security alert has been issued concerning veraPDF-validation, a component flagged within GitHub's Minecraft security advisories. Two distinct XML External Entity Injection (XXE) vulnerabilities, identified as CWE-611, expose systems to critical risks, allowing remote attackers to potentially read arbitrary files from server file systems and perform Server-Side Request Forgery (SSRF) attacks. This revelation underscores the importance of scrutinizing third-party dependencies, particularly for server administrators and mod developers whose infrastructure might process untrusted PDF documents.

Two Pathways to Exploitation

The advisories detail two separate methods through which these XXE vulnerabilities can be exploited, both involving specially crafted PDF files.

The first vulnerability, found in the validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java file within the getRichTextStringOrStreamEntryStringRepresentation() method, leverages malicious rich-text (/RC or /RV) entries embedded in a PDF. When veraPDF-validation processes such a document, its default XML parsing configuration, lacking essential security features, allows external entities to be resolved. The expanded content of these entities is then reflected directly into the validation report, providing a channel for data exfiltration.

The second vulnerability resides in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java, specifically within the getdynamicRender() method. This flaw targets the processing of malicious XFA streams embedded in a PDF's /AcroForm dictionary. Similar to the first, the DocumentBuilderFactory used here is instantiated with insecure default settings, enabling the parsing of attacker-controlled XML from the decoded XFA stream. While the direct output of the <dynamicRender> node might not always appear in reports, reliable data exfiltration can still be achieved through out-of-band parameter-entity techniques.

How it Works: The XXE Mechanism

XML External Entity (XXE) injection is a type of attack against an application that parses XML input. This attack occurs when an XML parser processes an XML document containing a reference to an external entity, and the parser is configured to resolve these external entities without proper security restrictions.

In the case of veraPDF-validation, the core issue lies with the DocumentBuilderFactory being initialized with default, insecure settings. This means:

• No disallow-doctype-decl: Allows <!DOCTYPE> declarations that can define external entities.
• External Entities Enabled: Both external general and parameter entities are not explicitly disabled.
• No FEATURE_SECURE_PROCESSING: The parser isn't forced into a secure processing mode.
• No Secure EntityResolver: No custom resolver is in place to restrict entity resolution.

When a crafted PDF with an embedded XML structure (either rich-text or XFA) is fed to veraPDF-validation, the vulnerable XML parser reads the external entity definition. This definition can point to local files (e.g., /etc/passwd on Linux, C:\Windows\win.ini on Windows) or internal network resources. Because the parser is configured to resolve these, it fetches the content from the specified location. Depending on the specific vulnerability, this content is either directly echoed into the validation report (rich-text XXE) or can be exfiltrated via an out-of-band channel (XFA XXE, for example, by forcing the server to make a request to an attacker-controlled server containing the sensitive data). The Server-Side Request Forgery (SSRF) aspect arises because the server can be forced to make requests to arbitrary URLs, potentially probing internal networks or interacting with internal services.

Why This Matters

For the Minecraft community, particularly those operating servers, developing mods, or managing complex infrastructure, these veraPDF-validation vulnerabilities present a tangible threat. While veraPDF-validation might not be a direct component of the Minecraft game client or server software itself, its presence in broader development or operational workflows is plausible. For instance, a server network might use a document validation service that incorporates veraPDF to process user-submitted content (e.g., for moderation, legal compliance, or community events involving documents). A mod developer might use it in their build pipeline or a web service related to their mod.

• For Server Administrators: If your server infrastructure or any connected services process user-submitted PDFs through veraPDF-validation, you are at risk. An attacker could exploit this to read sensitive configuration files, access private network resources, or even potentially pivot to other systems. It is crucial to identify if veraPDF-validation is a dependency in your stack and ensure it is updated or configured securely. For more insights on server security, visit our /servers section.
• For Mod Developers: Similarly, if your development tools, build servers, or any web services you operate for your mods utilize veraPDF-validation for PDF processing, you should assess your exposure. The ability to read arbitrary files or perform SSRF on a build server could compromise source code, private keys, or other critical assets. Stay informed on critical issues by checking our /news and /tech sections.
• General Awareness: This incident highlights the broader supply chain security risks in software development. Even components seemingly unrelated to the core game can introduce significant vulnerabilities if they are part of the ecosystem surrounding Minecraft. Developers and administrators should maintain vigilance regarding all third-party libraries and tools they integrate.

FAQ

Sources

• GitHub Security Advisory: veraPDF Validation XXE via Rich Text
• GitHub Security Advisory: veraPDF Validation XXE via XFA