Critical XXE Vulnerability in libapache-poi-java: Risk of Local File Exposure
Summary
DEBIAN-CVE-2019-12415: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from intern... Affects libapache-poi-java versions 4.0.1-1 – 4.0.1-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libapache-poi-java is a Java library used for reading and writing Microsoft Office documents, including Excel files. It provides a wide range of features for manipulating spreadsheets, making it a popular choice among developers. However, versions up to 4.1.0 are vulnerable to an XML External Entity (XXE) processing issue when using the XSSFExportToXml tool, which can lead to unauthorized access to local files or internal network resources.
Vulnerability Detail
In Apache POI versions up to 4.1.0, a vulnerability exists when the XSSFExportToXml tool processes user-provided Excel documents. An attacker can craft a malicious document that exploits XML External Entity (XXE) processing, allowing them to read files from the local filesystem or internal network resources. This vulnerability poses significant risks, including data leakage and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or user-provided Excel documents with the XSSFExportToXml tool until the package is updated. Additionally, consider disabling XML External Entity processing in your application if possible.
Conclusion
The XXE vulnerability in libapache-poi-java poses serious risks to applications that process user-provided Excel documents. It is crucial to update to a patched version to safeguard against potential data breaches and unauthorized access. Implementing workarounds and utilizing tools like Vulert can further enhance security measures.
See every vulnerability recorded for libapache-poi-java →
FAQ
The vulnerability allows attackers to exploit XML External Entity processing, potentially leading to unauthorized file access.
All versions of libapache-poi-java up to and including 4.1.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to data leakage, unauthorized access to sensitive files, and potential compromise of internal network resources.
Yes, a patched version of libapache-poi-java is available. Update to a version later than 4.1.0 to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
