Regular Expression Denial of Service in ExcelJS

Executive Summary

ExcelJS through version 4.4.0 has a regular expression denial of service (ReDoS) vulnerability in the slideFormula function. This flaw occurs when translating shared formulas to child cells in spreadsheets. Attackers can exploit it by creating a spreadsheet with extremely long master formulas, such as repeated hyphens, which triggers excessive regex backtracking. This consumes significant CPU resources and blocks the Node.js event loop, making the application unresponsive.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to applications using ExcelJS library versions through 4.4.0. To detect it, check if your system runs applications that use ExcelJS by inspecting package.json files or dependency lists for the exceljs package version 4.4.0 or earlier.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your Node.js application using ExcelJS to become unresponsive or crash when processing malicious spreadsheets. It may lead to denial of service, disrupting services that rely on ExcelJS for spreadsheet operations. Users could experience slow performance or complete system hangs if the event loop is blocked.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ExcelJS to version 4.4.1 or later to patch the regex denial of service vulnerability. If updating is not possible, consider removing or replacing the library in affected applications until an update is applied.

Useful 0 Not Useful 0