A critical vulnerability (CVE-2023-7101) has been identified in the Perl module Spreadsheet::ParseExcel, which provides functions for parsing Excel files, allowing arbitrary code execution when processing XLS or XLSX files that contain specially formatted number formatting rules. The vulnerability is caused by the use of data obtained from the processed file when building the 'eval' call. The issue has been resolved in the Spreadsheet::ParseExcel update 0.66. There is a prototype exploit available. Vulnerable code: if ( $format_str =~ /^\[([=][^\]]+)\](.*)$/ ) { $conditional = $1; $format_str = $2; } … $section = eval "$number $conditional" ? 0 : 1; Example of an exploit to execute the whoami command: 123;system('whoami > /tmp/inject.txt')]123"/>
The vulnerability was discovered by Barracuda Networks during an analysis of an attack involving malware placement on Barracuda ESG (Email Security Gateway) devices. The compromise of these devices was due to a 0-day vulnerability (CVE-2023-7102) in the Spreadsheet::ParseExcel module, used in Barracuda ESG to parse email attachments in Excel format. It was sufficient to send an email with a specially crafted attachment to execute code on systems using Barracuda ESG.
Izvor: opennet.ru
