A critical vulnerability (CVE-2023-7101) has been discovered in the Perl module Spreadsheet::ParseExcel, which provides functions for parsing Excel files. This vulnerability allows arbitrary code execution when processing XLS or XLSX files that include specially crafted number formatting rules. The vulnerability arises from using data obtained from the processed file when constructing the 'eval' call. The issue has been addressed in the Spreadsheet::ParseExcel 0.66 update. There is a prototype exploit available. Vulnerable code: if ( $format_str =~ /^\[([=][^\]]+)\](.*)$/ ) { $conditional = $1; $format_str = $2; } … $section = eval "$number $conditional" ? 0 : 1; Example exploit for executing the whoami command: 123;system('whoami > /tmp/inject.txt')]123"/>
The vulnerability was identified by Barracuda Networks while analyzing a malware deployment attack on Barracuda ESG (Email Security Gateway) devices. The compromise was due to a 0-day vulnerability (CVE-2023-7102) in the Spreadsheet::ParseExcel module used in Barracuda ESG for parsing email attachments in Excel format. To execute their code on systems using Barracuda ESG, it was sufficient to send an email with a specially crafted email attachment.
Source: opennet.ru
