CVE-2017-5992

What it actually does

The library parses .xlsx files (which are ZIP archives containing XML) with XML external entity resolution enabled by default, allowing crafted documents to read arbitrary local files or initiate outbound network requests during deserialization.

Why it matters to the business

Organizations that accept or process spreadsheet files from external parties risk unintended exposure of internal data or unintended network activity originating from the parsing system.

How an attack unfolds

An attacker creates a malicious .xlsx containing XML with external entity declarations that reference local files or internal services, then delivers the file to a target application or user that uses the vulnerable library to read it, causing the parser to resolve and potentially exfiltrate the referenced content.

How to fix it

Upgrade to a version containing commit 3b4905f428e1 or later; if upgrade is not possible, configure the parser to disable external entity resolution before loading any untrusted .xlsx content.

How to confirm the fix worked

Confirm the installed version is at or above the fixed commit; test by attempting to parse a minimal XXE-crafted .xlsx and verifying that external entity expansion is rejected or produces no sensitive output.

Typical attack path

1. Attacker crafts .xlsx with XXE payload in sharedStrings.xml or other XML parts
2. Malicious file is uploaded or opened by an application using the vulnerable library
3. Library parses the XML with entity resolution enabled
4. External entities are fetched, resulting in local file read or SSRF
5. Attacker receives exfiltrated data via out-of-band channel or error responses

How to detect it

Inspect application logs for XML parser warnings, unexpected file reads, or outbound connections triggered during .xlsx processing; review any error messages containing references to file:// or internal resource paths.

What your security team should do

• Prioritize upgrade of openpyxl to the fixed version in all environments that parse user-supplied spreadsheets
• Add input validation or sandboxing around spreadsheet parsing code until patched
• Review logs for any unexpected file-access or network requests during .xlsx processing