3

We have completed a vulnerability and a penetration test. One feature of our application allows for documents to be uploaded, and we allow for PDF documents.

Prior to a document being accepted we scan for Virus and ensure the document is a valid PDF. All of this is fine.

A CVSS Risk of medium was assigned to this feature because we don't scan for embedded malicious Javascript, or as the report suggest "malicious code". Of course there is no definition of malicious JS code.

From reading adobe's documentation [1], it seems a reasonable effort is made to determine if the JS code is malicious.

My Questions:

  1. Are the efforts from adobe[1] sufficient?

  2. It is reasonable to expect us to block all PDF files with embedded JS?

  3. There doesn't seem to be a lot of noise / chatter about embedded JS in PDF files, suggesting others don't see this an issue, would this be true to say?

  4. If we dont scan for embedded JS, is it reasonable to be a CVSS score of medium?

  5. What are the general use cases for embedded JS within PDF's. In case we block such PDF's a user will be prevented from uploading certain PDF files.

  6. What is the worst someone can do with this embedded JS facility in PDF, we know the PDF JS is sandboxed from the Web Application so it is not XSS to the web application ?

[1] Adobe Documentation https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/javascript.html#javascript-invoked-urls

  • 3
    These are many questions around use of JS in PDF which essentially ask in multiple ways if JS in PDF is really a problem in your specific case and how much of a problem it is. Only, not enough is known about your case, i.e. why do you need to accept PDF uploads in the first place and why do you need to accept PDF which includes JS. And what do you do with these PDF then. Answering these questions helps to determine how much JS in PDF is a problem for you and how to limit the risk. – Steffen Ullrich Oct 16 '18 at 18:22
  • 1
    One main use case is : users upload CV's as PDF's, the hiring managers can view these CV's. I suppose I am asking why JS is useful in the first place as an embedded component for PDF. – Darragh Oct 16 '18 at 21:06
  • Many of these questions are highly subjective. For example, what is sufficient and reasonable in your specific case? Question 4 has a more objective answer though. CVSS applies to actual vulnerabilities. Not blocking JS simply increases attack surface area and is not, on its own, a vulnerability. – forest Oct 16 '18 at 22:04
  • Yes agreed many of the questions are subjective. I also agree that not blocking JS increases the attack surface. I am trying to determine in general, by default should the position be to block the PDF JS embedded code. And, also to what extent does the JS facilitate malicious code. For example using the JS Prompt, can the content of the users response be pushed to an external malicious site? – Darragh Oct 17 '18 at 12:19
  • If I sent you a PDF file right now, would you open it? – Tom K. Oct 17 '18 at 14:21
1

To start with, on the Adobe page you are linking to, it says:

An untrusted document that tries to invoke an URL via JS displays the YMB by default. The user is given the option to trust the document for such actions via the Options button on the YMB.

In practice, this "effort" IMHO is next to useless, as PDFs would possibly circulate through your organization, and, one could imagine that there will always be one, more or less careless person, who presses the button. And that could mean opening pandora's box.

You need to understand that passing a PDF around which contains any malicious code is like passing a parcel around that contains a bomb. Even worse if copies get made. Bombs don't replicate, PDFs do. And we cannot tell when and where it may explode. So it's better not to want to let it in at all.

This then boils down to the question you are asking already, is it reasonable not to accept PDFs with embedded JS? If we are talking only CVs, my initial intuition would be: "Absolutely". I cannot see why a CV would need any interactivity in the document which would be the only use case for embedded JS, that I can think of. Typically, embedded JS can be used for PDFs which contain forms that can be filled in by the reader where one could choose from options for example.

That leaves you with the question of either scanning and rejecting PDFs with embedded JS code or to remove the embedded JS code during the scan procedure. The latter, is not really a technical or security question but there may or may not be legal aspects to that.

  • I think this is a reasonable answer to the use case presented i.e. CV uploading - thank you. Based on your comments, and, in my experience dynamic PDF documents are rare. Would it not be reasonable therefore, for most email systems to block PDF embedded JS files? It has not been my experience that email systems would block by default such PDF files. – Darragh Oct 18 '18 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.