Spreadsheet::ParseExcel · Spreadsheet::ParseExcel
CVE-2023-7101
Arbitrary Code Execution (ACE) Vulnerability
Was es ist
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CISA: Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
Was zu tun ist
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 23. Januar 2024
- Zur CISA-Liste hinzugefügt
- 2. Januar 2024
- Veröffentlicht
- 24. Dezember 2023
- Schweregrad
- Hoch 7,8 CVSS 3.1
- Wahrscheinlichkeit von Angriffen in den nächsten 30 Tagen (EPSS)
- 19% unter den obersten 2,7% aller bekannten Schwachstellen
- Schwachstellentyp
- CWE-95
- Mehr Details
- NVD · CVE.org · CISA
Alle Quellen (11)
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
- https://https://www.cve.org/CVERecord?id=CVE-2023-7101
- https://https://metacpan.org/dist/Spreadsheet-ParseExcel
- https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreads…
- http://www.openwall.com/lists/oss-security/2023/12/29/4
- https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html
- https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQL…
- https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.