RSEC-2023-0

Dashboard / Vulnerabilities / RSEC-2023-0

RSEC-2023-0

Summary: Out-of-bounds write and stack based buffer overflow vulnerabilities

Details: The readxl R package, versions 0.1.0 to 1.0.0, is vulnerable to multiple attack vectors due to the underlying use of the libxls library. Several exploitable vulnerabilities have been identified in different functions of libxls versions 1.3.4 and 1.4. These include out-of-bounds write and stack based buffer overflow vulnerabilities in the xls_mergedCells and xls_getfcell functions respectively. Furthermore, integer overflow vulnerabilities exist in the xls_preparseWorkSheet and xls_appendSST functions when handling MULBLANK, MULRK records and a shared string table (SST). An additional out-of-bounds vulnerability has been identified in the xls_addCell function when it processes a formula record. All these vulnerabilities can lead to memory corruption, potentially resulting in remote code execution. The exploit is triggered when a specially crafted XLS file, possibly sent by an attacker, is processed by these vulnerable functions.

References: https://readxl.tidyverse.org/news/index.html#readxl-110, https://github.com/tidyverse/readxl/issues/441, https://github.com/tidyverse/readxl/pull/442, https://security-tracker.debian.org/tracker/CVE-2017-2896, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0403, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0404, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0426, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0460, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0461, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0462, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0463, https://github.com/evanmiller/libxls/issues/34