Apache POI XXE Vulnerability in libapache-poi-java: Arbitrary File Read Risk
Summary
CVE-2014-3529: The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML E... Affects libapache-poi-java versions < 3.10.1-1. Fixed in 3.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular open-source library used for reading and writing Microsoft Office file formats in Java applications. It provides support for various formats, including Excel, Word, and PowerPoint. The library is widely utilized in enterprise applications for document manipulation and generation. However, prior to version 3.10.1, it was vulnerable to an XML External Entity (XXE) attack, which could allow attackers to read arbitrary files on the server where the application is hosted.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3529, arises from the OPC SAX setup in Apache POI versions before 3.10.1. It allows remote attackers to exploit an OpenXML file that contains an XML external entity declaration along with an entity reference. This can lead to unauthorized access to sensitive files on the server, potentially exposing confidential information and compromising the integrity of the application. The issue is categorized as an XXE vulnerability, which is a common security flaw in XML parsers that can be exploited if not properly mitigated.
How To Fix
Minimum fixed version
3.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-poi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider disabling XML external entity processing in your application. This can often be done by configuring the XML parser settings to prevent the processing of external entities. For example, if using a SAX parser, you can set the following property:
System.setProperty("javax.xml.XMLParser", "com.sun.org.apache.xerces.internal.jaxp.SAXParserFactory");
This will help mitigate the risk until the library can be updated.
Conclusion
The CVE-2014-3529 vulnerability in Apache POI poses a significant risk by allowing unauthorized file access through XXE attacks. It is crucial for users of libapache-poi-java to upgrade to version 3.10.1-1 or later to mitigate this risk. Additionally, temporary workarounds can be employed to enhance security until the upgrade is completed.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2014-3529 is a vulnerability in Apache POI that allows remote attackers to read arbitrary files through an XML external entity declaration in OpenXML files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The main risk is unauthorized access to sensitive files on the server, which can lead to data breaches and compromise the security of the application.
Yes, you can disable XML external entity processing in your application as a temporary workaround until an upgrade can be performed.
All versions of libapache-poi-java prior to 3.10.1 are affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
