I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls
/Filespec type objects.
As far as I get it, this means that a PDF can make a reference to a local file (or even a remote file using URI scheme) when opening the PDF. This would be a pretty neat way of attacking some servers I'm in charge of, because such server accepts user-uploaded PDF, opens them with wkhtml/tcpdf/jasper to make changes in that PDF, and then resend this PDF to the user. So if the user-uploaded PDF contains a file reference to, say,
/dev/random, and if that reference is used as the PDF's page content, then it would open up a breach to read arbitrary server's file content?
I would like to test that, but I can't make such PDF exploit: when opening the PDF I've forged on my lab (ie: not server, just a basic PDF reader), then no content is displayed (and PDF is considered broken).
So do you have some example of such PDF with a working file reference (so I can test if PDF processor is vulnerable to it)? Or any reference stating that these
/Filespec cannot be used to read arbitrary file's content (so no need to test the PDF processor)?