CVE-2023-7101 Spreadsheet::ParseExcel Spreadsheet::ParseExcel: command or code injection
In plain words: The program treats text it receives as instructions instead of plain data. The attacker can run commands on the machine — often the whole device is taken over.
Confirmed exploited by CISA on · US federal patch deadline Jan 23, 2024
What to do
- Install Spreadsheet::ParseExcel's security update for Spreadsheet::ParseExcel. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Turn on automatic updates for the operating system and for Office, PDF and archive apps.
- Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
- Use a normal (non-admin) account day to day and keep built-in protection like Microsoft Defender on.
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Your files, saved passwords and accounts. Many of these let a program that is already running gain full administrator control.
The details
- Official name
- Spreadsheet::ParseExcel Remote Code Execution Vulnerability
- Product
- Spreadsheet::ParseExcel Spreadsheet::ParseExcel
- CISA description
- Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
- Type of flaw
- Command or code injection (CWE-95)
- Confirmed exploited
- Jan 2, 2024
- US federal patch deadline
- Jan 23, 2024
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2023-7101 ·
Questions about CVE-2023-7101
Is CVE-2023-7101 being exploited?
Yes. CISA added CVE-2023-7101 to its Known Exploited Vulnerabilities catalog on Jan 2, 2024, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2023-7101?
Install Spreadsheet::ParseExcel's security update for Spreadsheet::ParseExcel. If no update exists, follow the vendor's workaround or stop using the product until one ships. Turn on automatic updates for the operating system and for Office, PDF and archive apps.
Am I affected by CVE-2023-7101?
Only if you use Spreadsheet::ParseExcel Spreadsheet::ParseExcel. This one is aimed at devices or apps of the kind people own.