Denial of Service Vulnerability in libapache-poi-java: XML Entity Expansion Attack
Summary
UBUNTU-CVE-2017-5644: Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. Affects libapache-poi-java versions 3.10.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache-poi-java is a Java library used for reading and writing Microsoft Office documents. It provides a wide range of functionalities for manipulating various file formats, including Excel and Word. However, versions prior to 3.15 are susceptible to a denial of service vulnerability that can be exploited through specially crafted OOXML files.
Vulnerability Detail
The vulnerability identified as CVE-2017-5644 allows remote attackers to exploit Apache POI versions prior to 3.15 by sending a specially crafted OOXML file. This can lead to excessive CPU consumption, effectively causing a denial of service. The attack leverages an XML Entity Expansion (XEE) technique, which can overwhelm the parser and degrade system performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the types of OOXML files that can be processed by your application. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The CVE-2017-5644 vulnerability in libapache-poi-java poses a significant risk of denial of service through XML Entity Expansion attacks. It is crucial to update to version 3.15 or later to mitigate this risk. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in your applications.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2017-5644 is a vulnerability in Apache POI that allows remote attackers to cause denial of service through specially crafted OOXML files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to significant CPU consumption, potentially causing your application to become unresponsive.
Yes, updating to libapache-poi-java version 3.15 or later will patch this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
