We have completed a vulnerability and a penetration test. One feature of our application allows for documents to be uploaded, and we allow for PDF documents.
Prior to a document being accepted we scan for Virus and ensure the document is a valid PDF. All of this is fine.
From reading adobe's documentation , it seems a reasonable effort is made to determine if the JS code is malicious.
Are the efforts from adobe sufficient?
It is reasonable to expect us to block all PDF files with embedded JS?
There doesn't seem to be a lot of noise / chatter about embedded JS in PDF files, suggesting others don't see this an issue, would this be true to say?
If we dont scan for embedded JS, is it reasonable to be a CVSS score of medium?
What are the general use cases for embedded JS within PDF's. In case we block such PDF's a user will be prevented from uploading certain PDF files.
What is the worst someone can do with this embedded JS facility in PDF, we know the PDF JS is sandboxed from the Web Application so it is not XSS to the web application ?