Denial of Service Vulnerability in Apache POI (CVE-2014-3574)
Summary
CVE-2014-3574: Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack. Affects libapache-poi-java versions < 3.10.1-1. Fixed in 3.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular open-source library used for reading and writing Microsoft Office file formats, including OOXML (Office Open XML) and OLE2 (Object Linking and Embedding). It provides a robust API for developers to manipulate spreadsheet, document, and presentation files in Java applications. However, certain versions of Apache POI are vulnerable to a denial of service attack due to improper handling of crafted OOXML files, which can lead to excessive CPU consumption and application crashes.
Vulnerability Detail
The vulnerability identified as CVE-2014-3574 affects Apache POI versions prior to 3.10.1 and 3.11.x before 3.11-beta2. It allows remote attackers to exploit the library by sending specially crafted OOXML files that trigger an XML Entity Expansion (XEE) attack. This type of attack can cause the application to consume excessive CPU resources, potentially leading to a denial of service condition where the application becomes unresponsive or crashes. The root cause lies in the library's failure to properly handle nested XML entities, which can be exploited by attackers to create deeply nested structures that overwhelm the parser.
How To Fix
Minimum fixed version
3.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-poi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to reject any OOXML files that contain suspicious or overly complex XML structures. Additionally, monitor application performance and CPU usage closely when processing OOXML files to detect potential denial of service attempts early.
Conclusion
CVE-2014-3574 is a significant vulnerability in Apache POI that can lead to denial of service through crafted OOXML files. Users are strongly advised to upgrade to the latest versions of the library to mitigate this risk. In the meantime, implementing workarounds can help protect applications from potential exploitation.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2014-3574 is a vulnerability in Apache POI that allows remote attackers to cause denial of service through crafted OOXML files.
Apache POI versions before 3.10.1 and 3.11.x before 3.11-beta2 are affected by this vulnerability.
Exploitation of this vulnerability can lead to high CPU consumption and application crashes, resulting in denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation to reject suspicious OOXML files and monitor application performance closely.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
