Cross Site Scripting - PDF upload

3 replies
85 views
Translate All

We recently completed our year‑end penetration testing for the application and identified a medium‑severity issue. The system does not restrict or sanitize PDF uploads that contain embedded JavaScript code. An attacker could upload a specially crafted PDF with embedded JavaScript, and if a privileged user later opens the PDF in a PDF reader, the JavaScript may execute within the reader process.

As a remediation, can we block or reject PDF files that contain embedded JavaScript during upload?

konstantyn_diachenko

Community Advisor

Hi @Vijaya_KrishnaKo ,

Yes. You can remediate this by validating uploaded PDFs server-side and rejecting any files that contain embedded JavaScript or active actions (e.g., /JavaScript, /JS, /OpenAction). This can be implemented using a PDF parsing library (such as Apache PDFBox) during upload. Additionally, PDFs can be re-saved or converted to remove active content as a defense-in-depth measure.

Discover capabilities of the PDFBox library (https://pdfbox.apache.org/). It allows accessing global JS or page-level JS actions.

Translate

Kostiantyn Diachenko, Community Advisor, Certified Senior AEM Developer, creator of free AEM VLT Tool, maintainer of AEM Tools plugin.

kautuk_sahni

Level 9

Thanks for proposing this idea. This has been reported to the engineering under the internal reference ASSETS-64644. The product team will triage this request to verify feasibility based on the prioritization model. This post will be updated according to Jira’s status.

Translate

Kautuk Sahni

kautuk_sahni

Level 9

New→Investigating

Translate

Kautuk Sahni

Sign up

Login with SSO

Login to the community

Login with SSO