Denial of Service Vulnerability in Apache POI (CVE-2017-5644)
Summary
CVE-2017-5644: Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. Affects libapache-poi-java across 2 version ranges.
< 3.17-1
< bbe3bb2ce95ffda4c89cba558f76d17f75c8bc84
Fixed in 3.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular Java library used for reading and writing Microsoft Office documents, including Excel and Word files. It provides a wide range of features for manipulating these file formats, making it a critical tool for applications that require document generation or processing. However, certain versions of Apache POI prior to 3.15 are vulnerable to a denial of service attack due to improper handling of specially crafted OOXML files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5644, allows remote attackers to exploit Apache POI by sending a specially crafted OOXML file. This file can trigger an XML Entity Expansion (XEE) attack, leading to excessive CPU consumption and potentially causing a denial of service. The issue arises from the library's inability to properly handle large or complex XML entities, which can result in resource exhaustion on the server processing the document.
How To Fix
Minimum fixed version
3.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-poi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of OOXML files that can be processed by your application. Additionally, you can limit the resources allocated to the process handling these files to mitigate the impact of a potential attack.
Conclusion
CVE-2017-5644 represents a significant denial of service vulnerability in Apache POI that can be exploited through specially crafted OOXML files. It is crucial for users of affected versions to upgrade to the latest version to mitigate this risk. Implementing workarounds can provide temporary relief while a permanent fix is applied.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2017-5644 is a vulnerability in Apache POI that allows remote attackers to cause denial of service through specially crafted OOXML files.
Versions of Apache POI prior to 3.15 are affected by this vulnerability.
The primary consequence is denial of service due to excessive CPU consumption when processing malicious OOXML files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2017-5644 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
