XXE injection is possible via specially crafted excel file about excel-reader-xlsx HOT 6 CLOSED

Hi Evgeny,

Thanks for highlighting that vulnerability.

Just to note that this project was never released to CPAN, hasn't been worked on since April 2012, and is effectively abandoned. There are maintained solutions such as Spreadsheet::ParseXLSX that people should be using instead.

John

from excel-reader-xlsx.

Hi John,

Thanks for clarification. I just came across the bug in several projects that were using this module for xlsx processing. Just wanted to leave the report here for those who will possibly use code as a reminder that they will need to fix the issue themselves.

Evgeny

from excel-reader-xlsx.

Thanks.

Is there a workaround for this issue?

from excel-reader-xlsx.

It should be something like

my $xml_reader = XML::LibXML::Reader->new(
        location  => $filename,
        load_ext_dtd => 0,
        expand_entities => 0,
        no_blanks => 1,
        no_network => 1
    );

during XML parser init. Sure, I can send a PR, but it'll take some time because I'm not a Perl developer at all =)

from excel-reader-xlsx.

I've pushed a fix for this to master. If you encounter users with this vulnerability you can ask them to upgrade or better still to use a supported module.

Either way, thank you for the report.

from excel-reader-xlsx.

@luc-lynx Where to add this payload in excel files kindly make a video for it. Using Linux LibreOffice. Also Office other files Word,PP, ETC.

from excel-reader-xlsx.