---
title: "Spreadsheet::ParseExcel CVE-2023-7101: Excel-File Perl RCE"
url: https://erroneo.us/security/briefs/spreadsheet-parseexcel-cve-2023-7101-barracuda-esg-rce/
description: "Perl's Spreadsheet::ParseExcel 0.65 runs code hidden in Excel number formats; China-nexus UNC4841 used it on Barracuda ESG. Fixed in 0.66. Find old copies."
type: security-brief
section: "Security Digest"
date_published: 2023-12-24
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-7101"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Spreadsheet::ParseExcel CVE-2023-7101: Excel-File Perl RCE

**Verdict: Check exposure.** Barracuda ESG fixed itself automatically in December 2023; the lingering risk is Perl code that still parses untrusted spreadsheets with Spreadsheet::ParseExcel 0.65 or older, often in vendored or appliance copies.

- **Who must act:** Teams running Perl services, mail filters or appliances that parse uploaded or emailed XLS/XLSX files with Spreadsheet::ParseExcel 0.65 or earlier, directly or through Spreadsheet::ParseXLSX.
- **Who can relax:** Barracuda ESG customers, whose appliances received the fix automatically on Dec 21, 2023, and Perl installs already on ParseExcel 0.66 or a patched Debian package.
- **Affected:** Spreadsheet::ParseExcel 0.65 and earlier; Spreadsheet::ParseXLSX and other code that formats cells through ParseExcel 0.65 or earlier; Barracuda ESG appliance 5.1.3.001 through 9.2.1.001 before the Dec 21, 2023 update (CVE-2023-7102)
- **Fixed:** Spreadsheet::ParseExcel 0.66 (Dec 29, 2023); Debian libspreadsheet-parseexcel-perl 0.6500-1+deb10u1 (buster), 0.6500-1.1+deb11u1 (bullseye), 0.6500-4~deb12u1 (bookworm); Barracuda ESG: automatic security update of Dec 21, 2023
- **CVEs:** CVE-2023-7101
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Print the installed version on every Perl host: perl -MSpreadsheet::ParseExcel -e 'print $Spreadsheet::ParseExcel::VERSION'.
2. Upgrade to 0.66 with cpanm, or install your distro's patched package.
3. Grep codebases, vendored lib/ trees and container images for the vulnerable line eval "$number $conditional" and replace those copies.
4. Run spreadsheet parsing in a low-privilege, sandboxed worker with no outbound network access.
5. Barracuda ESG owners: confirm the appliance is receiving updates and check it against Barracuda's December 2023 indicators.

### How to check if you are affected

- Search stored or quarantined XLS/XLSX files for number formats that start with a [<, [> or [= condition followed by anything other than a number.
- Look for shell, curl or wget processes spawned by the Perl service that parses spreadsheets.
- Check Barracuda ESG appliances for the SEASPY and SALTWATER indicators Barracuda published on Dec 24, 2023.

## What happened

On December 24, 2023, Barracuda [disclosed](https://trust.barracuda.com/security/information/esg-vulnerability) that attackers had sent "a specially crafted Excel email attachment" to a limited number of its Email Security Gateway (ESG) appliances. The attachments triggered a code execution flaw in Spreadsheet::ParseExcel, an open-source Perl module the appliance used to read spreadsheets. Barracuda and Mandiant attributed the activity to UNC4841, a China-nexus group that had already exploited ESG earlier in 2023. New variants of the SEASPY and SALTWATER malware were installed on some devices. Two CVEs followed, both issued by Mandiant as the numbering authority: CVE-2023-7102 for Barracuda's use of the library and CVE-2023-7101 for the library itself.

The bug is simple. Excel number formats can begin with a condition such as `[>100]`, and ParseExcel 0.65 evaluated that condition with Perl's string `eval`. The [Mandiant disclosure](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md) says crafted formats in XLS or XLSX files therefore run arbitrary code "during the parsing process." Mandiant also says modules built on ParseExcel, such as Spreadsheet::ParseXLSX, are affected. The researcher who found it published a [proof of concept](https://github.com/haile01/perl_spreadsheet_excel_rce_poc) in March 2023, after failing to reach the maintainer. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-7101) scores it 7.8.

## Who is affected

Any Perl code that opens untrusted spreadsheets with Spreadsheet::ParseExcel 0.65 or earlier. That includes mail and document pipelines, upload handlers, reporting tools and appliances. When Mandiant published, no fixed release existed. The [CPAN Security Group](https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html) then reached a former maintainer, who released 0.66 with a [patch](https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc) that replaces the `eval` with explicit comparisons. [MetaCPAN](https://metacpan.org/dist/Spreadsheet-ParseExcel) lists 0.66, released December 29, 2023, as the latest version. Debian backported the fix to its 0.65 packages (see the [tracker](https://security-tracker.debian.org/tracker/CVE-2023-7101)). On the Barracuda side, CVE-2023-7102 covers ESG 5.1.3.001 through 9.2.1.001. Barracuda pushed a fix to all active appliances automatically on December 21, 2023, and a cleanup patch to compromised ones the next day.

## Do you really need to act?

ESG customers do not; Barracuda said no customer action was required. For everyone else, the question is whether you parse spreadsheets you did not create. Perl modules are often copied into application trees, baked into images or bundled in vendor products, so a 2023 fix on CPAN does not mean your copy changed. If a service parses attacker-supplied files with an old copy, opening one file is enough to run code as that service. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101) on January 2, 2024.

## What to do now

1. Check the version: `perl -MSpreadsheet::ParseExcel -e 'print $Spreadsheet::ParseExcel::VERSION'`.
2. Upgrade: `cpanm Spreadsheet::ParseExcel@0.66`, or `sudo apt install --only-upgrade libspreadsheet-parseexcel-perl` on Debian.
3. Find vendored copies: `grep -rnF 'eval "$number $conditional"' /srv /opt /usr/share/perl5`, and include container image layers.
4. Parse untrusted spreadsheets in a sandboxed, low-privilege worker with no outbound network.
5. If you run Barracuda ESG, confirm it is receiving updates and compare it with Barracuda's published indicators.

## How to tell if you were hit

Look at the files themselves. For XLSX, `unzip -p file.xlsx xl/styles.xml | grep -o 'formatCode="\[[^"]*"'` lists bracketed formats (the XML escapes the operators as `&gt;` and `&lt;`); a condition followed by anything other than a number is suspect. For XLS, run `strings` and look for the same pattern. On hosts that parse spreadsheets, look for shells, `curl` or `wget` spawned by the Perl process, and for unexpected outbound connections. ESG owners should check Barracuda's host and network indicators for the December 2023 SEASPY and SALTWATER variants.

## Timeline

- Mar 15, 2023 — The researcher publishes a proof of concept on GitHub.
- Dec 21, 2023 — Barracuda pushes an automatic fix to all active ESG appliances.
- Dec 24, 2023 — Barracuda discloses the attacks, and Mandiant publishes CVE-2023-7101 and CVE-2023-7102.
- Dec 29, 2023 — Spreadsheet::ParseExcel 0.66 is released with the fix.
- Jan 2, 2024 — CISA adds CVE-2023-7101 to KEV.
- Jan 23, 2024 — CISA's remediation deadline for federal agencies.

## Sources

1. [MetaCPAN — Spreadsheet-ParseExcel](https://metacpan.org/dist/Spreadsheet-ParseExcel)
2. [Mandiant — MNDT-2023-0019: Spreadsheet::ParseExcel arbitrary code execution](https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md)
3. [Barracuda — Barracuda Email Security Gateway vulnerability](https://trust.barracuda.com/security/information/esg-vulnerability)
4. [CVE record — CVE-2023-7101](https://www.cve.org/CVERecord?id=CVE-2023-7101)
5. [NVD — CVE-2023-7101](https://nvd.nist.gov/vuln/detail/CVE-2023-7101)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-7101](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101)
7. [GitHub — fix commit: Do not use string eval for conditional formatting](https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc)
8. [CPAN Security Group — Vulnerable Spreadsheet Parsing modules](https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html)
9. [Debian security tracker — CVE-2023-7101](https://security-tracker.debian.org/tracker/CVE-2023-7101)
10. [Le Dinh Hai — ParseExcel RCE proof of concept](https://github.com/haile01/perl_spreadsheet_excel_rce_poc)

---
Source page: https://erroneo.us/security/briefs/spreadsheet-parseexcel-cve-2023-7101-barracuda-esg-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt