Executive brief
SheetJS Pro is a JavaScript library used to read and write Excel files. A crafted XLSX file can cause the library to consume excessive memory, causing the application to become unresponsive or crash. This can impact any service or application that processes user-supplied Excel files without validation.
Technical details
This vulnerability is a denial of service caused by improper handling of crafted XLSX documents in SheetJS Pro's xlsx.js library. The root cause is uncontrolled memory consumption (CWE-400) when parsing malicious Excel files. An attacker can craft a specially formatted .xlsx file that, when processed by the library, triggers excessive memory allocation leading to application crash or hang. User interaction is required (the file must be opened/read by the application). The vulnerability affects all versions through 0.16.9 and is fixed in version 0.17.0 or later.
Affected products
- SheetJS xlsx through 0.16.9
Timeline
- 2021-07-22: disclosed
- 2021-07-22: patched: Fixed in version 0.17.0