CVE-2023-7101
Description
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Summary dbcve.org
Spreadsheet::ParseExcel v0.65 Perl module contains an arbitrary code execution vulnerability where Number format strings from Excel files are passed to a string-type eval() without validation. An attacker can craft a malicious Excel file containing specially formatted number format strings that, when parsed, execute arbitrary Perl code on the target system.
Mitigation
Update Spreadsheet::ParseExcel to the latest patched version that validates or removes the unsafe eval() usage for Number format strings. Audit all applications and systems using this library and rebuild/redeploy them with the updated dependency.