高危

Spreadsheet-ParseExcel安全漏洞

2023-12-24 21:34:46 公开，2026-02-27 05:58:58 更新

APT漏洞
CISA KEV
关键漏洞
漏洞攻击链
RCE
公开PoC
本地
无需认证
开源组件漏洞
CWE Top 25 (2023)
CWE Top 25 (2024)

CWEs：: CWE-95 （Eval Injection）
CAPEC：: CAPEC-137 （Parameter Injection）
SSVC：: 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-08-20 11:56:14

风险信息

CVSS v3.1 向量: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v3.1 风险值: 7.8

详细信息

漏洞类型: 其他
漏洞描述: Spreadsheet-ParseExcel是爱尔兰John McNamara个人开发者的一个模块，用于从Excel文件中提取信息。Spreadsheet::ParseExcel版本0.65由于Excel解析逻辑中对Number格式字符串（不要与printf风格的格式字符串混淆）的评估，将未经验证的输入从文件传递到字符串类型eval中。通过说服受害者打开特制的内容，攻击者可以利用此漏洞在系统上执行任意代码。
修复建议: 截至2023年12月24日，没有可用的补救措施

参考链接

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
NVD · Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-7101
NVD · Third Party Advisory
https://metacpan.org/dist/Spreadsheet-ParseExcel
NVD · Product
https://github.com/haile01/perl_spreadsheet_excel_rce_poc
NVD · Third Party Advisory
https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171
NVD · Product
http://www.openwall.com/lists/oss-security/2023/12/29/4
NVD · Mailing List · Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html
NVD · Mailing List · Third Party Advisory
https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
NVD · Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/
NVD · Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/
NVD · Mailing List
https://osv.dev/vulnerability/DLA-3702-1
OSV
https://osv.dev/vulnerability/DSA-5592-1
OSV
https://security-tracker.debian.org/tracker/CVE-2023-7101
OSV
https://github.com/r-gregmisc/gdata/issues/14
OSV
https://osv.dev/vulnerability/RSEC-2023-9
OSV
https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
NVD · Third Party Advisory
https://ubuntu.com/security/CVE-2023-7101
OSV
https://github.com/runrig/spreadsheet-parseexcel/issues/33
OSV
https://ubuntu.com/security/notices/USN-6781-1
OSV
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
https://osv.dev/vulnerability/UBUNTU-CVE-2023-7101
OSV
https://osv.dev/vulnerability/CVE-2023-7101
OSV
https://osv.dev/vulnerability/DEBIAN-CVE-2023-7101
OSV
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101
NVD