A critical XXE vulnerability in PDFPatcher versions up to 1.1.3.4663 allows unauthenticated attackers to read arbitrary files and perform SSRF attacks.

The XML bookmark import feature fails to disable external entity resolution within the .NET XmlDocument class. This allows an unauthenticated attacker to supply a malicious XML file to trigger arbitrary file reads, out-of-band data exfiltration, or SSRF attacks.

This vulnerability poses a significant risk to data confidentiality and internal network integrity. Successful exploitation allows an attacker to extract sensitive local files from the host system or pivot into internal network infrastructure through SSRF. With a CVSS score of 7.1, the vulnerability is classified as High, reflecting the potential for severe information disclosure and unauthorized access to internal resources.

Immediate Action: As no official patch is currently identified, users should exercise extreme caution when importing XML files from untrusted sources. Monitor vendor channels for updates and transition to alternative software if this functionality is critical but unprotected.

Proactive Monitoring: Monitor network traffic for unusual outbound HTTP requests originating from the host system, which may indicate attempted OOB data exfiltration. Review system access logs for anomalous file read patterns.

Compensating Controls: If the software must remain in use, ensure it is executed within a highly restricted environment, such as a sandbox or a container with minimal filesystem and network access. Disable network access for the application to prevent SSRF and OOB exfiltration.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the security researcher's technical write-up.

Given the availability of a published proof-of-concept and the high impact of XXE vulnerabilities, organizations should prioritize restricting the use of the PDFPatcher bookmark import feature. Administrators must treat this as a high-priority risk and implement strict network isolation until a formal security update is released by the vendor.