Junglewise Threat Intelligence

CVE-2017-12626: Apache POI denial of service in document parsing

CVE-2017-12626 · Severity: high · CVSS 7.5 · Published 2021-01-14

Technologies: org.apache.poi:poi (Maven). Vendors: Apache, Maven.

Executive brief

Apache POI is a popular Java library used by applications to read and write Microsoft Office file formats like Word, Excel, and PowerPoint. A vulnerability in older versions allows an attacker to crash an application or cause it to become unresponsive by providing specially crafted documents. This can lead to a denial-of-service condition, impacting business operations that rely on automated document processing.

Technical details

Apache POI versions prior to 3.17 contain multiple flaws in its document parsing logic. Specifically, the library is susceptible to infinite loops (CWE-835) when processing crafted WMF, EMF, MSG, and macro files. Additionally, it can trigger Out of Memory (OOM) exceptions when parsing specially crafted DOC, PPT, and XLS files. An attacker can exploit these vulnerabilities by submitting a malicious file to an application that uses the library for processing, requiring no authentication or user interaction beyond the application attempting to parse the file. The issues were addressed in the release of Apache POI 3.17.

Affected products

  • Apache POI < 3.17

Timeline

  • 2017-09-20: patched: Apache POI 3.17 released
  • 2018-01-29: advisory: NVD published CVE-2017-12626
  • 2021-01-14: advisory: GitHub Advisory published

References

Related threats