CVE-2022-23640 Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader
An attacker can exploit XML External Entity vulnerabilities in the Excel-Streaming-Reader library to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23640?
CVE-2022-23640 is a critical vulnerability in monitorjbl excel-streaming-reader, published on 2 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.
Which versions are affected by CVE-2022-23640?
2 open source packages ship an affected version, including com.monitorjbl:xlsx-streamer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.monitorjbl:xlsx-streamer Maven | All versions | 2.1.0 |
com.monitorjbl:xlsx-streamer Maven | All versions | 2.1.0 |
Products include Excel Streaming Reader Project Excel Streaming Reader.
How do I fix CVE-2022-23640?
Upgrade com.monitorjbl:xlsx-streamer to 2.1.0 or later.
Is CVE-2022-23640 being exploited?
There is no known exploitation of CVE-2022-23640 in the wild and no public exploit code.
Sources
Also known as GHSA-xvm2-9xvc-hx7f.