Spreadsheet::ParseExcel · Spreadsheet::ParseExcel
CVE-2023-7101
Arbitrary Code Execution (ACE) Vulnerability
What it is
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CISA: Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: January 23, 2024
- Added to the CISA list
- January 2, 2024
- Published
- December 24, 2023
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 19% in the top 2.7% of all known vulnerabilities
- Weakness
- CWE-95
- More details
- NVD · CVE.org · CISA
All references (11)
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
- https://https://www.cve.org/CVERecord?id=CVE-2023-7101
- https://https://metacpan.org/dist/Spreadsheet-ParseExcel
- https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreads…
- http://www.openwall.com/lists/oss-security/2023/12/29/4
- https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html
- https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQL…
- https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.