Actively exploited · Published Dec 24, 2023 · Assigned by Mandiant
CVE-2023-7101Arbitrary Code Execution (ACE) Vulnerability
High 7.8 Exploited
In plain English
A high-severity security flaw in Spreadsheet::ParseExcel from Douglas Wilson. Attackers are actively exploiting it in the wild (listed by CISA on January 2, 2024). The chance it is exploited in the next 30 days is estimated at 19.0% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 23, 2024.
Official description
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | perl-spreadsheet-parseexcel | 0.66-r0 | ALPINE-CVE-2023-7101 |
| Alpine:v3.21 | perl-spreadsheet-parseexcel | 0.66-r0 | ALPINE-CVE-2023-7101 |
| Alpine:v3.22 | perl-spreadsheet-parseexcel | 0.66-r0 | ALPINE-CVE-2023-7101 |
| Alpine:v3.23 | perl-spreadsheet-parseexcel | 0.66-r0 | ALPINE-CVE-2023-7101 |
| Alpine:v3.24 | perl-spreadsheet-parseexcel | 0.66-r0 | ALPINE-CVE-2023-7101 |
| Debian:12 | libspreadsheet-parseexcel-perl | 0.6500-4~deb12u1 | DSA-5592-1 |
| Debian:12 | libspreadsheet-parseexcel-perl | 0.6500-4~deb12u1 | DEBIAN-CVE-2023-7101 |
| Debian:13 | libspreadsheet-parseexcel-perl | 0.6500-4 | DEBIAN-CVE-2023-7101 |
| Debian:14 | libspreadsheet-parseexcel-perl | 0.6500-4 | DEBIAN-CVE-2023-7101 |
| Ubuntu:22.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1.1ubuntu0.1 | UBUNTU-CVE-2023-7101 |
| Ubuntu:22.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1.1ubuntu0.1 | USN-6781-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Douglas Wilson | Spreadsheet::ParseExcel | 0.65 |
Weakness: CWE-95 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
- https://https://www.cve.org/CVERecord?id=CVE-2023-7101
- https://https://metacpan.org/dist/Spreadsheet-ParseExcel
- https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171
- http://www.openwall.com/lists/oss-security/2023/12/29/4
- https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html
- https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/
- https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101 government-resource