Arbitrary File Read in ExcelJS via Malicious Image Path Injection

Executive Summary

ExcelJS through version 4.4.0 has an arbitrary file read vulnerability in the streaming WorkbookWriter feature. Attackers can exploit this by providing specially crafted image filenames to the addImage function. The vulnerability allows path traversal attacks using ../ segments in image paths, which causes the addMedia function to embed any file readable by the Node.js process into the generated Excel workbook under the xl/media directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Node.js applications using ExcelJS versions before 4.4.1 for suspicious addImage calls with path traversal patterns like ../ in image filenames. Check generated Excel files for unexpected embedded files under xl/media. Monitor logs for file read errors or unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive files on your system if you are using a vulnerable version of ExcelJS. Attackers could potentially access configuration files, credentials, or other confidential data stored on the server where the application runs. This could lead to further compromise of the system or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, which would violate GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions of ExcelJS may face compliance violations, legal penalties, and reputational damage if this vulnerability is exploited to access protected health information or personally identifiable information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ExcelJS to version 4.4.1 or later. Review and sanitize all user-controlled inputs used in addImage calls to prevent path traversal. Implement strict input validation for filenames. Restrict file system permissions for the Node.js process to limit file access.

Useful 0 Not Useful 0