Apache POI - XML External Entity (XXE) Processing
Summary
CVE-2019-12415: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from intern... Affects libapache-poi-java versions < 444e35e0d903f0b4fac96e8c8668953b196dabd4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular Java library used for reading and writing Microsoft Office file formats, including Excel. It provides APIs to manipulate and extract data from Excel documents. However, versions up to 4.1.0 of Apache POI are vulnerable to XML External Entity (XXE) Processing. This vulnerability allows an attacker to read files from the local filesystem or internal network resources by exploiting specially crafted Excel documents.
Vulnerability Detail
The vulnerability (CVE-2019-12415) in Apache POI arises due to improper handling of user-provided Excel documents during conversion using the XSSFExportToXml tool. By leveraging XML External Entity (XXE) Processing, an attacker can include malicious XML entities in the document, which can lead to the disclosure of sensitive information. This can have serious consequences, such as unauthorized access to files or internal network resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid using the XSSFExportToXml tool with untrusted or user-provided Excel documents. Additionally, it is recommended to implement input validation and sanitization techniques to mitigate the risk of XXE attacks.
Conclusion
The XML External Entity (XXE) Processing vulnerability in Apache POI up to version 4.1.0 can allow an attacker to read files from the local filesystem or internal network resources. It is crucial to update to a patched version of Apache POI to mitigate the risk of exploitation. Implementing input validation and sanitization techniques can also help reduce the impact of XXE attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libapache-poi-java →
FAQ
Apache POI is a Java library for working with Microsoft Office file formats, including Excel. It provides APIs to read, write, and manipulate Excel documents.
XML External Entity (XXE) Processing is a vulnerability that allows an attacker to read files from the local filesystem or internal network resources by exploiting the processing of external entities in XML documents.
This vulnerability can be exploited by crafting a malicious Excel document that contains specially crafted XML entities. When the document is processed using the XSSFExportToXml tool, the XXE vulnerability is triggered, allowing the attacker to access sensitive files or resources.
The potential consequences of this vulnerability include unauthorized access to sensitive files, disclosure of confidential information, and potential compromise of internal network resources.
Yes, this vulnerability has been patched in versions of Apache POI released after 4.1.0. It is recommended to update to the latest stable release to ensure the vulnerability is fixed.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
