Memory Exhaustion in ExcelJS via Unbounded Image Anchor

Executive Summary

This is a memory exhaustion vulnerability in ExcelJS versions up to 4.4.0. Attackers can crash applications by creating a malicious Excel file with an extremely large image anchor column (e.g., 300000000). When the getImages() method processes this file, it attempts to allocate millions of Column objects, causing a heap out-of-memory error.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Excel files for unusually large anchor column values in xl/drawings/drawing1.xml. Use tools like grep or a hex editor to search for anchor columns exceeding normal ranges (e.g., values like 300000000).

For systems using ExcelJS, monitor for heap out-of-memory errors when processing Excel files. Check application logs for crashes during getImages() calls or Worksheet.getColumn operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing applications that use ExcelJS to process untrusted files. It requires no privileges or user interaction, making it exploitable remotely. Systems may become unresponsive or require restart after encountering the memory error.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ExcelJS to version 4.4.1 or later, or exceljs-hardened to 5.1.0 or later to patch the vulnerability. Avoid opening untrusted Excel files, especially those with large anchor column values.

Implement input validation to reject Excel files with anchor columns exceeding reasonable limits. Use sandboxing or resource limits to prevent memory exhaustion during file processing.

Useful 0 Not Useful 0