Spreadsheet::ParseExcel CVE-2023-7101: Excel-File Perl RCE

What to do

1. Print the installed version on every Perl host: perl -MSpreadsheet::ParseExcel -e 'print $Spreadsheet::ParseExcel::VERSION'.
2. Upgrade to 0.66 with cpanm, or install your distro's patched package.
3. Grep codebases, vendored lib/ trees and container images for the vulnerable line eval "$number $conditional" and replace those copies.
4. Run spreadsheet parsing in a low-privilege, sandboxed worker with no outbound network access.
5. Barracuda ESG owners: confirm the appliance is receiving updates and check it against Barracuda's December 2023 indicators.

How to check if you are affected or compromised

• Search stored or quarantined XLS/XLSX files for number formats that start with a [<, [> or [= condition followed by anything other than a number.
• Look for shell, curl or wget processes spawned by the Perl service that parses spreadsheets.
• Check Barracuda ESG appliances for the SEASPY and SALTWATER indicators Barracuda published on Dec 24, 2023.

What happened#

On December 24, 2023, Barracuda disclosed that attackers had sent "a specially crafted Excel email attachment" to a limited number of its Email Security Gateway (ESG) appliances. The attachments triggered a code execution flaw in Spreadsheet::ParseExcel, an open-source Perl module the appliance used to read spreadsheets. Barracuda and Mandiant attributed the activity to UNC4841, a China-nexus group that had already exploited ESG earlier in 2023. New variants of the SEASPY and SALTWATER malware were installed on some devices. Two CVEs followed, both issued by Mandiant as the numbering authority: CVE-2023-7102 for Barracuda's use of the library and CVE-2023-7101 for the library itself.

The bug is simple. Excel number formats can begin with a condition such as [>100], and ParseExcel 0.65 evaluated that condition with Perl's string eval. The Mandiant disclosure says crafted formats in XLS or XLSX files therefore run arbitrary code "during the parsing process." Mandiant also says modules built on ParseExcel, such as Spreadsheet::ParseXLSX, are affected. The researcher who found it published a proof of concept in March 2023, after failing to reach the maintainer. NVD scores it 7.8.

Who is affected#

Any Perl code that opens untrusted spreadsheets with Spreadsheet::ParseExcel 0.65 or earlier. That includes mail and document pipelines, upload handlers, reporting tools and appliances. When Mandiant published, no fixed release existed. The CPAN Security Group then reached a former maintainer, who released 0.66 with a patch that replaces the eval with explicit comparisons. MetaCPAN lists 0.66, released December 29, 2023, as the latest version. Debian backported the fix to its 0.65 packages (see the tracker). On the Barracuda side, CVE-2023-7102 covers ESG 5.1.3.001 through 9.2.1.001. Barracuda pushed a fix to all active appliances automatically on December 21, 2023, and a cleanup patch to compromised ones the next day.

Do you really need to act?#

ESG customers do not; Barracuda said no customer action was required. For everyone else, the question is whether you parse spreadsheets you did not create. Perl modules are often copied into application trees, baked into images or bundled in vendor products, so a 2023 fix on CPAN does not mean your copy changed. If a service parses attacker-supplied files with an old copy, opening one file is enough to run code as that service. CISA added the CVE to KEV on January 2, 2024.

What to do now#

1. Check the version: perl -MSpreadsheet::ParseExcel -e 'print $Spreadsheet::ParseExcel::VERSION'.
2. Upgrade: cpanm Spreadsheet::ParseExcel@0.66, or sudo apt install --only-upgrade libspreadsheet-parseexcel-perl on Debian.
3. Find vendored copies: grep -rnF 'eval "$number $conditional"' /srv /opt /usr/share/perl5, and include container image layers.
4. Parse untrusted spreadsheets in a sandboxed, low-privilege worker with no outbound network.
5. If you run Barracuda ESG, confirm it is receiving updates and compare it with Barracuda's published indicators.

How to tell if you were hit#

Look at the files themselves. For XLSX, unzip -p file.xlsx xl/styles.xml | grep -o 'formatCode="\[[^"]*"' lists bracketed formats (the XML escapes the operators as > and <); a condition followed by anything other than a number is suspect. For XLS, run strings and look for the same pattern. On hosts that parse spreadsheets, look for shells, curl or wget spawned by the Perl process, and for unexpected outbound connections. ESG owners should check Barracuda's host and network indicators for the December 2023 SEASPY and SALTWATER variants.

Timeline#

• Mar 15, 2023 — The researcher publishes a proof of concept on GitHub.
• Dec 21, 2023 — Barracuda pushes an automatic fix to all active ESG appliances.
• Dec 24, 2023 — Barracuda discloses the attacks, and Mandiant publishes CVE-2023-7101 and CVE-2023-7102.
• Dec 29, 2023 — Spreadsheet::ParseExcel 0.66 is released with the fix.
• Jan 2, 2024 — CISA adds CVE-2023-7101 to KEV.
• Jan 23, 2024 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2023-7101 · KEV 2024-01-02 · Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. MetaCPAN — Spreadsheet-ParseExcel metacpan.org
2. Mandiant — MNDT-2023-0019: Spreadsheet::ParseExcel arbitrary code execution github.com
3. Barracuda — Barracuda Email Security Gateway vulnerability trust.barracuda.com
4. CVE record — CVE-2023-7101 cve.org
5. NVD — CVE-2023-7101 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-7101 cisa.gov
7. GitHub — fix commit: Do not use string eval for conditional formatting github.com
8. CPAN Security Group — Vulnerable Spreadsheet Parsing modules security.metacpan.org
9. Debian security tracker — CVE-2023-7101 security-tracker.debian.org
10. Le Dinh Hai — ParseExcel RCE proof of concept github.com