CVE-2019-12415: Apache POI - Improper Restriction of XML External Entity Reference
Summary
CVE-2019-12415: Improper Restriction of XML External Entity Reference in Apache POI. Affects org.apache.poi:poi versions < 4.1.1. Fixed in 4.1.1. How to fix ↓
Also tracked for
- libapache-poi-java · Debian:11
The same CVE-2019-12415 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular Java library used for reading and writing Microsoft Office file formats, including Excel documents. It provides APIs to manipulate and extract data from these files. However, versions up to 4.1.0 of Apache POI are vulnerable to an XML External Entity (XXE) Processing issue when converting user-provided Excel documents using the XSSFExportToXml tool. This vulnerability allows an attacker to read files from the local filesystem or internal network resources.
Vulnerability Detail
The vulnerability arises due to improper restriction of XML external entity references. An attacker can exploit this by crafting a malicious Excel document that includes specially crafted XML entities. When the document is processed by the XSSFExportToXml tool, the XXE vulnerability is triggered, allowing the attacker to read sensitive files or internal network resources. This can lead to unauthorized access to sensitive information or facilitate further attacks.
How To Fix
Minimum fixed version
4.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the XSSFExportToXml tool or restrict its usage to trusted sources. This can be achieved by modifying the code that invokes the XSSFExportToXml tool or by implementing input validation to ensure that only trusted Excel documents are processed.
Conclusion
The CVE-2019-12415 vulnerability in Apache POI allows an attacker to read files from the local filesystem or internal network resources by exploiting an XML External Entity (XXE) Processing issue. Upgrading to Apache POI version 4.1.1 or later is the recommended solution. If immediate upgrade is not possible, disabling or restricting the usage of the XSSFExportToXml tool can serve as a temporary workaround. For further assistance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.poi:poi →
FAQ
Apache POI is a Java library for working with Microsoft Office file formats, including Excel documents. It provides APIs to read, write, and manipulate these files.
XML External Entity (XXE) Processing is a vulnerability that allows an attacker to read files from the local filesystem or internal network resources by exploiting XML entity references.
The CVE-2019-12415 vulnerability affects Apache POI versions up to 4.1.0. It allows an attacker to read sensitive files or internal network resources by crafting a malicious Excel document and exploiting the XXE vulnerability in the XSSFExportToXml tool.
The potential consequences of this vulnerability include unauthorized access to sensitive information stored in files on the local filesystem or internal network resources. This can lead to data breaches, exposure of sensitive data, or further exploitation of the compromised system.
To mitigate the CVE-2019-12415 vulnerability, it is recommended to upgrade to Apache POI version 4.1.1 or later. Alternatively, you can disable or restrict the usage of the XSSFExportToXml tool in your application until the upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.poi:poi.
