Quick answers
- Is CVE-2021-32013 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32013 being exploited in the wild.
- How severe is CVE-2021-32013?
- Low severity, with a CVSS score of 3.1, published 22 July 2021.
- Which products and versions are affected?
- org.webjars.npm:xlsx (Maven) ECOSYSTEM:introduced=0,fixed=0.17.0; xlsx (npm) SEMVER:introduced=0,fixed=0.17.0.
- Is there a fix for CVE-2021-32013?
- Yes. org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later; xlsx (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32013 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2021-32013?
- Check whether you run org.webjars.npm:xlsx (Maven) or xlsx (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- org.webjars.npm:xlsx (Maven): upgrade to 0.17.0 or later
# set org.webjars.npm:xlsx to 0.17.0 in your pom.xml or build.gradle - xlsx (npm): upgrade to 0.17.0 or later
npm install xlsx@0.17.0
Technical details
This vulnerability is a denial of service caused by improper handling of crafted XLSX documents in SheetJS Pro's xlsx.js library. The root cause is uncontrolled memory consumption (CWE-400) when parsing malicious Excel files. An attacker can craft a specially formatted .xlsx file that, when processed by the library, triggers excessive memory allocation leading to application crash or hang. User interaction is required (the file must be opened/read by the application). The vulnerability affects all versions through 0.16.9 and is fixed in version 0.17.0 or later.
Affected products
- SheetJS xlsx through 0.16.9
Identifiers
- CVE-2021-32013
- GHSA-8vcr-vxm8-293m
Timeline
- 2021-07-22: disclosed
- 2021-07-22: patched: Fixed in version 0.17.0