PT-2023-8146 · Unknown+4 · Spreadsheet::Parseexcel+4
Đình Hải Lê
+1
·
Publicado
2023-12-21
·
Atualizado
2025-10-31
·
CVE-2023-7101
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Spreadsheet::ParseExcel version 0.65
Description
The issue is related to the evaluation of Number format strings within the Excel parsing logic, which allows for arbitrary code execution due to passing unvalidated input from a file into a string-type
eval. This vulnerability can be exploited when processing XLS or XLSX files that include specially crafted number formatting rules. The problem is caused by the use of data from the processed file when building the eval call.Recommendations
For Spreadsheet::ParseExcel version 0.65, upgrade to version 0.66 to fix the issue. As a temporary workaround, consider disabling the use of Number format strings within the Excel parsing logic until a patch is available. Restrict access to the
eval function to minimize the risk of exploitation. Avoid using the eval function with unvalidated input from files.Exploit
Correção
Code Injection
Eval Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Linuxmint
Spreadsheet::Parseexcel
Suse
Ubuntu