CVE-2023-7101
Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Description
CVE-2023-7101 is a HIGH severity arbitrary code execution vulnerability in Spreadsheet::ParseExcel version 0.65, a widely used Perl module for parsing Microsoft Excel files. The vulnerability arises from the module passing unvalidated Number format strings from within an Excel file directly into a Perl string-type eval() call, enabling attacker-controlled code injection through a crafted Excel document. Any application that uses Spreadsheet::ParseExcel to process untrusted Excel files is potentially vulnerable, including security products such as Barracuda Email Security Gateway, which was separately targeted using this flaw. CVE-2023-7101 is listed in CISA’s Known Exploited Vulnerabilities catalog and carries an EPSS score of 83.3% (99.2nd percentile), reflecting active and widespread exploitation of this vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jmcnamara | spreadsheet\ | <= 0.65 |
| debian | debian linux | 10.0 |
| fedoraproject | fedora | 38; 39 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2023/12/29/4(Mailing List, Patch, Third Party Advisory)
- https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171(Product)
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md(Third Party Advisory)
- https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc(Broken Link, Third Party Advisory)
- https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc(Broken Link, Patch)
- https://https://metacpan.org/dist/Spreadsheet-ParseExcel(Broken Link, Product)
- https://https://www.cve.org/CVERecord?id=CVE-2023-7101(Broken Link, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/(Broken Link, Mailing List)
- https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101(US Government Resource)
Weakness Type
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)
CWE-95 describes a class of vulnerability where user-supplied or attacker-controlled input is incorporated into a dynamically evaluated code expression (such as a Perl eval(), Python exec(), or similar construct) without adequate sanitization. In CVE-2023-7101, Number format strings embedded within attacker-crafted Excel files are passed to a Perl string eval() call, allowing the attacker to inject and execute arbitrary Perl code.
Learn more: CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code
CWE-94: Improper Control of Generation of Code (Code Injection)
CWE-94 covers weaknesses where an attacker can influence the structure or content of code that is generated or dynamically executed by the application. For CVE-2023-7101, the eval injection directly results in code injection, as attacker-provided strings from the Excel Number format field are executed as arbitrary Perl statements by the Spreadsheet::ParseExcel module.
Learn more: CWE-94 — Improper Control of Generation of Code (Code Injection)
Impact Analysis
CVE-2023-7101 carries a CVSS 3.1 score of 7.8 (HIGH), with a local attack vector requiring user interaction, meaning a user or automated process must open or parse a malicious Excel file. In many real-world deployments, this interaction is automated — email security gateways, document processors, and data import pipelines regularly parse Excel files without human review, effectively making this exploitable remotely through social engineering or file delivery. Confidentiality (High): Successful code execution exposes all data accessible to the process running the Perl application. Integrity (High): Attackers can write files, modify system state, and establish persistence on the affected host. Availability (High): Services processing the malicious file can be disrupted or used as a launch point for further attacks. The EPSS score of 83.3% (99.2nd percentile) reflects that this vulnerability is being actively exploited in the wild across multiple target environments.
Exploit Maturity
CVE-2023-7101 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 23, 2024. A Mandiant vulnerability disclosure (MNDT-2023-0019) documents the issue in detail, and a public proof-of-concept exploit repository has been referenced in the advisory disclosures. The EPSS score of 83.3% (99.2nd percentile) confirms extremely high exploitation probability across internet-exposed systems. The vulnerability has been used against products embedding the Spreadsheet::ParseExcel library, broadening its real-world impact beyond direct Perl module users to downstream products that bundle or depend on the affected code.
Remediation
- Apply vendor-provided fixes: Per CISA KEV guidance, apply mitigations per vendor instructions. Update Spreadsheet::ParseExcel to a patched version. Review the upstream patch commit on GitHub that addresses the unsafe eval() usage to confirm your installed version includes the fix.
- Pin to a safe version via CPAN: For Perl environments, update the Spreadsheet::ParseExcel module via CPAN to the latest available version. Verify the version includes the fix by checking the module changelog or the patched commit referenced in the advisory.
- Avoid processing untrusted Excel files with unpatched versions: Until patching is complete, restrict application intake of Excel files to trusted, verified sources only. Do not permit end-user or external upload of Excel files to services backed by the vulnerable module.
- Apply code-level mitigations: Where modifying the library directly is possible, replace string-based eval() calls used for Number format string evaluation with safe, non-evaluating alternatives. Validate and allowlist Number format strings before any evaluation.
- Monitor for exploitation and check for downstream exposure: Applications embedding Spreadsheet::ParseExcel — including Barracuda Email Security Gateway and other email scanning products — may have received patches through their own update channels. Review vendor security bulletins for all products that depend on this library and audit logs for unexpected process executions triggered during Excel file parsing.
Technical Details
CVE-2023-7101 is an eval injection vulnerability (CWE-95, CWE-94) in the Spreadsheet::ParseExcel Perl module. The flaw exists in the Utility.pm file, specifically in the logic that evaluates Number format strings extracted from Excel binary data. When parsing an Excel file, the module extracts Number format strings to determine how numeric values should be displayed, and passes these strings into a Perl string-type eval() expression without first validating or sanitizing the content. This allows an attacker who controls the Excel file’s Number format definition to inject arbitrary Perl code that executes in the context of the parsing process. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects low attack complexity once the file is opened, requiring no special privileges and achieving complete host-level impact. A proof-of-concept demonstrating the RCE condition was published by Mandiant in their vulnerability disclosure, and a PoC repository is referenced in the advisory.
Frequently Asked Questions
Is CVE-2023-7101 being actively exploited?
Yes. CISA confirmed active exploitation of CVE-2023-7101 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 23, 2024. A Mandiant vulnerability disclosure and public proof-of-concept references are available. The EPSS score of 83.3% (99.2nd percentile) places this vulnerability among the most actively exploited in the wild.
What products are affected by CVE-2023-7101?
CVE-2023-7101 directly affects Spreadsheet::ParseExcel version 0.65 and likely earlier versions. It also indirectly affects any application or product embedding this Perl module for Excel parsing, including security products that process Excel attachments. Debian Linux and Fedora Linux package maintainers have also issued advisories for this vulnerability.
How do I fix CVE-2023-7101?
Update Spreadsheet::ParseExcel to the patched version via CPAN and apply any downstream product patches from vendors who embed this library. Until patched, restrict intake of untrusted Excel files in applications using this module. Review the upstream patch commit on GitHub to confirm the fix is present in your installed version.
How severe is CVE-2023-7101?
CVE-2023-7101 is rated HIGH with a CVSS 3.1 score of 7.8. The vulnerability enables arbitrary code execution by processing a malicious Excel file, with no special privileges required. Given its use in automated file processing pipelines and the 83.3% EPSS score reflecting active exploitation, it poses a significant risk to any system that processes Excel files using the affected Perl module.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.