Denial of Service in ExcelJS via Unbounded sheetId

Executive Summary

ExcelJS through version 4.4.0 has a denial of service vulnerability where attackers can block the event loop by providing an excessively large sheetId in the xl/workbook.xml file. This causes the sparse worksheet array to stall during operations like worksheets, getWorksheet, and writeBuffer, leading to delays of several seconds.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if ExcelJS versions prior to 4.4.1 are in use. Inspect package.json or dependency lists for ExcelJS versions <=4.4.0. No specific network commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using ExcelJS to become unresponsive or slow down significantly when processing files with large sheetIds. It may lead to degraded performance, timeouts, or crashes in systems relying on ExcelJS for file operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ExcelJS to version 4.4.1 or later to patch the denial of service vulnerability. Remove or restrict untrusted input handling in xl/workbook.xml processing if custom parsing is used.

Useful 0 Not Useful 0