PDF and embedded JavaScript

Question

We have completed a vulnerability and a penetration test. One feature of our application allows for documents to be uploaded, and we allow for PDF documents.

Prior to a document being accepted we scan for Virus and ensure the document is a valid PDF. All of this is fine.

A CVSS Risk of medium was assigned to this feature because we don't scan for embedded malicious Javascript, or as the report suggest "malicious code". Of course there is no definition of malicious JS code.

From reading adobe's documentation [1], it seems a reasonable effort is made to determine if the JS code is malicious.

My Questions:

1. Are the efforts from adobe[1] sufficient?

2. It is reasonable to expect us to block all PDF files with embedded JS?

3. There doesn't seem to be a lot of noise / chatter about embedded JS in PDF files, suggesting others don't see this an issue, would this be true to say?

4. If we dont scan for embedded JS, is it reasonable to be a CVSS score of medium?

5. What are the general use cases for embedded JS within PDF's. In case we block such PDF's a user will be prevented from uploading certain PDF files.

6. What is the worst someone can do with this embedded JS facility in PDF, we know the PDF JS is sandboxed from the Web Application so it is not XSS to the web application ?

[1] Adobe Documentation https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/javascript.html#javascript-invoked-urls

Answer 1

To start with, on the Adobe page you are linking to, it says:

An untrusted document that tries to invoke an URL via JS displays the YMB by default. The user is given the option to trust the document for such actions via the Options button on the YMB.

In practice, this "effort" IMHO is next to useless, as PDFs would possibly circulate through your organization, and, one could imagine that there will always be one, more or less careless person, who presses the button. And that could mean opening pandora's box.

You need to understand that passing a PDF around which contains any malicious code is like passing a parcel around that contains a bomb. Even worse if copies get made. Bombs don't replicate, PDFs do. And we cannot tell when and where it may explode. So it's better not to want to let it in at all.

This then boils down to the question you are asking already, is it reasonable not to accept PDFs with embedded JS? If we are talking only CVs, my initial intuition would be: "Absolutely". I cannot see why a CV would need any interactivity in the document which would be the only use case for embedded JS, that I can think of. Typically, embedded JS can be used for PDFs which contain forms that can be filled in by the reader where one could choose from options for example.

That leaves you with the question of either scanning and rejecting PDFs with embedded JS code or to remove the embedded JS code during the scan procedure. The latter, is not really a technical or security question but there may or may not be legal aspects to that.