CVE-2023-7101

What it actually does

Spreadsheet::ParseExcel 0.65 evaluates attacker-controlled Excel number-format strings using Perl string eval without sufficient validation. A malicious .xls file can embed a crafted number format that is interpreted as Perl code when an application parses the spreadsheet. Successful exploitation results in arbitrary code execution with the privileges of the process using the vulnerable Perl module, enabling file access, command execution, data theft, persistence, or lateral movement depending on the hosting application and runtime permissions.

Why it matters to the business

Any business process that ingests Excel files through this library can become an execution path for attacker-controlled code, including email gateways, document-processing pipelines, file-upload portals, ETL jobs, finance workflows, and security tools. Exploitation can lead to compromise of servers or workstations that process spreadsheets, theft or modification of sensitive data, service disruption, and follow-on intrusion activity. This vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2024-01-23, so unpatched use should be treated as overdue and high priority even though user or workflow interaction is typically required.

How an attack unfolds

An attacker creates a legacy Excel file containing a malicious number-format string designed to escape the expected formatting context and execute Perl code when parsed. The attacker then delivers the file through a path likely to be processed by software using Spreadsheet::ParseExcel, such as an email attachment, uploaded spreadsheet, automated import job, or document conversion workflow. When the vulnerable module parses the workbook, the number-format handling logic passes the attacker-controlled content into eval. The embedded code runs under the privileges of the parsing process. From there, the attacker may execute operating-system commands, drop additional tooling, open outbound network connections, read local files, steal credentials or secrets available to the process, or use the compromised system as a foothold for further activity. Active exploitation has been observed in the wild, so detection should assume crafted spreadsheets may have been used as the initial trigger rather than relying only on traditional network-facing exploit patterns.

How to fix it

Upgrade Spreadsheet::ParseExcel to a fixed release, generally version 0.66 or later, or install the corrected package from the operating-system vendor for Debian, Fedora, and other distributions that bundle the module. If the module is included transitively by an application, update the parent application or dependency lockfile so the vulnerable 0.65 release is no longer present. Rebuild and redeploy containers, appliances, serverless packages, and packaged applications that vendor the Perl module. If immediate upgrade is not possible, temporarily disable processing of legacy .xls files from untrusted sources, convert workflows to safer formats only after sandboxed inspection, isolate document parsing in a locked-down sandbox with no secrets and minimal filesystem/network access, and block outbound network access from parsing workers except where strictly required. Treat KEV-listed exposure as urgent and overdue relative to the 2024-01-23 CISA deadline.

How to confirm the fix worked

Confirm that no deployed application, package, container image, or appliance includes Spreadsheet::ParseExcel 0.65. On systems with Perl modules installed directly, check the installed module version using package managers and Perl module inventory commands, and verify the resolved runtime dependency is 0.66 or later. For OS-packaged versions, confirm the Debian, Fedora, or vendor advisory package containing the fix is installed, even if the package version uses distribution-specific backport numbering. Rebuild artifacts after dependency updates and rescan software bills of materials, container images, and host package inventories. Functionally validate by parsing benign .xls files in a test environment and confirming expected behavior. Where safe test harnesses are available, verify that crafted number-format content is rejected or treated as data rather than executed. Also confirm compensating controls: untrusted .xls processing disabled or sandboxed, parsing processes running with least privilege, and outbound egress from document-processing workloads restricted.

Typical attack path

1. Identify an application, gateway, automation job, or user workflow that parses .xls files with Spreadsheet::ParseExcel 0.65 or a vulnerable downstream package.
2. Craft a malicious legacy Excel workbook containing an attacker-controlled number-format string that triggers Perl eval during parsing.
3. Deliver the workbook through email, file upload, shared storage, ticketing, import/export, or another document-ingestion route.
4. Wait for the vulnerable process or user workflow to parse the file.
5. Achieve arbitrary code execution in the context of the Perl process running the parser.
6. Run shell commands, stage payloads, access files, or establish outbound command-and-control connectivity.
7. Use the compromised process permissions to steal data, persist, disrupt service, or pivot to adjacent systems.

How to detect it

Hunt for evidence that .xls files were parsed shortly before unusual command execution, file writes, or outbound connections from Perl-based processes. Useful log sources include endpoint detection telemetry, process creation logs, shell history where applicable, web or application upload logs, mail gateway attachment logs, document-conversion or import job logs, proxy/DNS/firewall logs, container runtime logs, and package or dependency inventories. Look for perl processes that spawn shells or download utilities, especially near the time an Excel attachment or upload was handled. Investigate unexpected child processes such as /bin/sh, bash, curl, wget, nc, python, perl -e, or similar launched by services that normally only parse documents. Review temporary directories, application upload directories, mail quarantine/extraction paths, and document-processing workspaces for recently created .xls files followed by scripts, web shells, binaries, archives, or cron/systemd persistence. In network telemetry, investigate outbound connections from spreadsheet-processing hosts or containers that do not normally initiate external traffic. Because the exploit payload is embedded in workbook formatting data, preserve original suspicious spreadsheets for offline forensic analysis and avoid opening them on production systems. There are no universal payload strings for this CVE, so detection should focus on the behavioral sequence: Excel ingestion, vulnerable parser execution, unexpected child process or network activity.

• Spreadsheet::ParseExcel
• Spreadsheet/ParseExcel
• Spreadsheet/ParseExcel/FmtDefault.pm
• ParseExcel.pm
• perl -> /bin/sh
• perl -> /bin/bash
• perl -> bash
• perl -> sh
• perl -> curl
• perl -> wget
• perl -> nc
• perl -> python
• perl -e
• /bin/sh -c
• /bin/bash -c
• bash -c
• curl http
• curl https
• wget http
• wget https
• nc -e
• ncat -e
• .xls

What your security team should do

• Immediately inventory all direct and transitive uses of Spreadsheet::ParseExcel, including applications, containers, appliances, document-processing services, email/security gateways, and automation jobs that ingest .xls files.
• Prioritize remediation for internet-facing upload paths, email attachment processing, automated spreadsheet import pipelines, and systems processing files from external parties.
• Upgrade to Spreadsheet::ParseExcel 0.66 or later, or apply the fixed Debian/Fedora/vendor package, then rebuild and redeploy all affected artifacts.
• Because this vulnerability is in CISA KEV and exploitation is active in the wild, treat remaining vulnerable instances as overdue exceptions requiring documented risk acceptance and compensating controls.
• Temporarily block, quarantine, or sandbox untrusted legacy .xls files until all parsing components are verified fixed.
• Run retrospective hunts for suspicious spreadsheet ingestion followed by Perl-spawned shells, command interpreters, download tools, or unexpected outbound network connections.
• Review privileges of document parsing processes and remove access to unnecessary credentials, sensitive directories, and internal network destinations.
• Add detection coverage for malicious document-processing behavior, especially perl processes launching /bin/sh, bash, curl, wget, nc, python, or other living-off-the-land tooling.
• Preserve suspicious .xls attachments/uploads and associated process, network, and file telemetry for forensic review.
• Monitor vendor advisories for downstream products that embed Spreadsheet::ParseExcel and apply product-specific updates even if the library is not directly managed.