Apache POI XXE Vulnerability in libapache-poi-java: Remote File Access Risk
Summary
DEBIAN-CVE-2016-5000: The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to... Affects libapache-poi-java versions 4.0.1-1 – 4.0.1-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache-poi-java is a Java library that provides APIs for manipulating various file formats based on the Office Open XML standards. It is widely used for reading and writing Microsoft Office documents. However, prior to version 3.14, it contained a vulnerability that allowed attackers to exploit XML External Entity (XXE) issues, potentially leading to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability identified as CVE-2016-5000 in Apache POI allows remote attackers to read arbitrary files by crafting an OpenXML document that contains an external entity declaration alongside an entity reference. This XXE issue can lead to significant security risks, including data leakage and unauthorized access to sensitive information stored on the server. The vulnerability affects all versions of libapache-poi-java before 3.14, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the processing of external entities in XML parsers if they are not needed. This can be done by configuring the XML parser settings to prevent the resolution of external entities, thereby reducing the risk of exploitation.
Conclusion
The CVE-2016-5000 vulnerability in libapache-poi-java poses a significant risk by allowing unauthorized file access through crafted OpenXML documents. Users are strongly advised to update to version 3.14 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2016-5000 is a vulnerability in Apache POI that allows remote attackers to read arbitrary files through crafted OpenXML documents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, data leakage, and potential exploitation of the server.
Yes, updating to version 3.14 or later of libapache-poi-java addresses the vulnerability.
If immediate updating is not possible, consider disabling external entity processing in your XML parsers as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
