CVE-2017-12626: Apache POI denial of service in document parsing

CVE-2017-12626 · Severity: high · CVSS 7.5 · Published 2021-01-14

Apache POI is a popular Java library used by applications to read and write Microsoft Office file formats like Word, Excel, and PowerPoint. A vulnerability in older versions allows an attacker to crash an application or cause it to become unresponsive by providing specially crafted documents. This can lead to a denial-of-service condition, impacting business operations that rely on automated document processing.

Technologies: org.apache.poi:poi (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2017-12626 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2017-12626 being exploited in the wild.
How severe is CVE-2017-12626?
High severity, with a CVSS score of 7.5, published 14 January 2021.
Which products and versions are affected?
Apache POI < 3.17; org.apache.poi:poi (Maven) < 3.17, ECOSYSTEM:introduced=0,fixed=3.17.
Is there a fix for CVE-2017-12626?
Yes. org.apache.poi:poi (Maven): upgrade to 3.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-12626 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2017-12626?
Check whether you run Apache POI or org.apache.poi:poi (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.poi:poi (Maven): upgrade to 3.17 or later
    # set org.apache.poi:poi to 3.17 in your pom.xml or build.gradle

Technical details

Apache POI versions prior to 3.17 contain multiple flaws in its document parsing logic. Specifically, the library is susceptible to infinite loops (CWE-835) when processing crafted WMF, EMF, MSG, and macro files. Additionally, it can trigger Out of Memory (OOM) exceptions when parsing specially crafted DOC, PPT, and XLS files. An attacker can exploit these vulnerabilities by submitting a malicious file to an application that uses the library for processing, requiring no authentication or user interaction beyond the application attempting to parse the file. The issues were addressed in the release of Apache POI 3.17.

Affected products

  • Apache POI < 3.17

Identifiers

  • CVE-2017-12626
  • GHSA-523c-xh4g-mh5m

Timeline

  • 2017-09-20: patched: Apache POI 3.17 released
  • 2018-01-29: advisory: NVD published CVE-2017-12626
  • 2021-01-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.