Executive brief
SheetJS is a popular library used by web applications to process Excel spreadsheets. A vulnerability in older versions allows an attacker to crash an application or exhaust its server memory by providing a specially crafted Excel file. This could lead to a service outage or significant performance degradation for any system that allows users to upload or process spreadsheet data.
Technical details
A Denial of Service (DoS) vulnerability exists in SheetJS (xlsx) and SheetJS Pro through version 0.16.9. The issue stems from uncontrolled resource consumption (CWE-400) within the xlsx.js component when reading a specially crafted .xlsx document. An attacker can exploit this by inducing a user or system to process a malicious file, leading to excessive memory consumption and eventual application crash. The vulnerability is triggered during the parsing phase. This issue was addressed in version 0.17.0.
Affected products
- SheetJS xlsx (SheetJS) <= 0.16.9
- SheetJS SheetJS Pro <= 0.16.9
Timeline
- 2021-07-19: disclosed: NVD publication date
- 2021-07-22: advisory: GitHub Advisory published
- 2021-07-19: patched: Version 0.17.0 released