CVE-2023-7101: 
Linux Debian vulnerability analysis and mitigation

Spreadsheet::ParseExcel version 0.65 and earlier contains an arbitrary code execution (ACE) vulnerability identified as CVE-2023-7101. The vulnerability exists in the Perl module used for parsing Excel files, where unvalidated input from a file can be passed into a string-type "eval" function. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic (Mandiant Disclosure, NVD).

The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). It has received a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue allows attackers to exploit the vulnerability by using specially crafted Number format strings within XLS and XLSX files, which can trigger the execution of arbitrary code during the parsing process (NVD, Mandiant Disclosure).

The vulnerability has a high impact rating as it enables arbitrary code execution. When parsing documents provided by a remote machine, this could result in Remote Code Execution (RCE). The vulnerability was allegedly used by UNC4841, a China-backed threat actor, to compromise Barracuda Email Security Gateway (ESG) appliances (MetaCPAN Security).

The vulnerability has been fixed in Spreadsheet::ParseExcel version 0.66. Users are strongly advised to upgrade to this version. The fix was provided by Daniel Ruoso and released by John McNamara. For systems that cannot be immediately updated, it is recommended to discontinue use of the product if mitigations are unavailable (OSS Security, MetaCPAN Security).

The vulnerability gained significant attention after being linked to attacks on Barracuda Email Security Gateway appliances. In response to the severity of the vulnerability, CISA added it to their Known Exploited Vulnerabilities Catalog on January 2, 2024, with a remediation due date of January 23, 2024. Various Linux distributions, including Debian and Fedora, quickly issued security updates to address the vulnerability (MetaCPAN Security).