Is CVE-2021-32012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32012 being exploited in the wild.

How severe is CVE-2021-32012?

Low severity, with a CVSS score of 3.1, published 22 July 2021.

Which products and versions are affected?

org.webjars.npm:xlsx (Maven) ECOSYSTEM:introduced=0,fixed=0.17.0; xlsx (npm) SEMVER:introduced=0,fixed=0.17.0; SheetJS Pro <= 0.16.9.

Is there a fix for CVE-2021-32012?

Yes. org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later; xlsx (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32012 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2021-32012?

Check whether you run org.webjars.npm:xlsx (Maven), xlsx (npm) or SheetJS Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32012: SheetJS xlsx denial of service via memory consumption

Q: Is there a fix for CVE-2021-32012?

Yes. org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later; xlsx (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2021-32012 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2021-32012?

Check whether you run org.webjars.npm:xlsx (Maven), xlsx (npm) or SheetJS Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32012 · Severity: low · CVSS 3.1 · Published 2021-07-22

SheetJS is a popular library used by web applications to process Excel spreadsheets. A vulnerability in older versions allows an attacker to crash an application or exhaust its server memory by providing a specially crafted Excel file. This could lead to a service outage or significant performance degradation for any system that allows users to upload or process spreadsheet data.

Technologies: org.webjars.npm:xlsx (Maven), xlsx (npm). Vendors: Maven, npm.

Quick answers

Is CVE-2021-32012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32012 being exploited in the wild.
How severe is CVE-2021-32012?: Low severity, with a CVSS score of 3.1, published 22 July 2021.
Which products and versions are affected?: org.webjars.npm:xlsx (Maven) ECOSYSTEM:introduced=0,fixed=0.17.0; xlsx (npm) SEMVER:introduced=0,fixed=0.17.0; SheetJS Pro <= 0.16.9.
Is there a fix for CVE-2021-32012?: Yes. org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later; xlsx (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32012 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2021-32012?: Check whether you run org.webjars.npm:xlsx (Maven), xlsx (npm) or SheetJS Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later

# set org.webjars.npm:xlsx to 0.17.0 in your pom.xml or build.gradle

xlsx (npm): upgrade to 0.17.0 or later
```
npm install xlsx@0.17.0
```

Technical details

A Denial of Service (DoS) vulnerability exists in SheetJS (xlsx) and SheetJS Pro through version 0.16.9. The issue stems from uncontrolled resource consumption (CWE-400) within the xlsx.js component when reading a specially crafted .xlsx document. An attacker can exploit this by inducing a user or system to process a malicious file, leading to excessive memory consumption and eventual application crash. The vulnerability is triggered during the parsing phase. This issue was addressed in version 0.17.0.

Affected products

SheetJS xlsx (SheetJS) <= 0.16.9
SheetJS SheetJS Pro <= 0.16.9

Identifiers

CVE-2021-32012
GHSA-3x9f-74h4-2fqr

Timeline

2021-07-19: disclosed: NVD publication date
2021-07-22: advisory: GitHub Advisory published
2021-07-19: patched: Version 0.17.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.