A Perl module Spreadsheet::ParseExcel, which provides functions for parsing Excel files, has a critical vulnerability (CVE-2023-7101) that allows arbitrary code execution when processing XLS or XLSX files containing specially crafted number formatting rules. The vulnerability is caused by using data obtained from the processed file to construct an 'eval' call. The issue was fixed in the Spreadsheet::ParseExcel 0.66 update. An exploit prototype exists. Vulnerable code: if ( $format_str =~ /^(\[(<>=][^\]]+)\](.*)$/ ) { $conditional = $1; $format_str = $2; } … $section = eval "$number $conditional" ? 0 : 1; Example exploit for executing the whoami command: 123;system('whoami > /tmp/inject.txt')]123"/>
The vulnerability was identified by Barracuda Networks while analyzing an attack involving malware deployment on Barracuda ESG (Email Security Gateway) devices. The compromise of devices was due to a 0-day vulnerability (CVE-2023-7102) in the Spreadsheet::ParseExcel module used in Barracuda ESG to parse Excel email attachments. To execute their code on systems using Barracuda ESG, it was sufficient to send an email with a specially crafted email attachment.
Forrás: opennet.ru
