CVE-2023-7101

CVE-2023-7101 is an arbitrary code execution flaw in version 0.65 of the Spreadsheet::ParseExcel Perl module, which is used to parse Microsoft Excel files: Excel 'Number format' strings taken from the file are passed into Perl's string-form eval() without validation (CWE-95), so embedded content is evaluated as Perl code. It is triggered whenever an application, script, or appliance using the module processes a maliciously crafted .xls file, meaning exploitation typically requires user interaction (opening or ingesting the file) consistent with the CVSS local-attack/user-interaction vector. A successful attacker gains code execution with the privileges of the process parsing the file, with high impact on confidentiality, integrity, and availability. Anyone running the vulnerable module is affected, including Debian and Fedora users of its packages and operators of products that bundle the library, and the flaw drew wide attention after it was implicated in the Barracuda Email Security Gateway zero-day exploitation attributed to Chinese-nexus hackers. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-01-02, confirming exploitation in the wild; EPSS assigns a roughly 19% probability of exploitation in the next 30 days (97th percentile), and no public proof-of-concept is known.

What to do: Upgrade Spreadsheet::ParseExcel to the vendor-patched release (version 0.65 is cited as vulnerable) via CPAN or by applying updated Debian/Fedora packages, and identify products that bundle the module, such as Barracuda ESG, applying those vendors' fixes per their instructions. Until patched, avoid processing untrusted .xls files with the module or restrict spreadsheet ingestion to trusted sources, and review systems where Perl code parses externally supplied spreadsheets for signs of exploitation. Ransomware linkage is currently unknown, per CISA.