Listen to this Post
Excelize parses shared-string cell values with strconv.Atoi.
It checks only the upper bound before indexing the shared string slice.
If an XLSX file contains a shared-string cell with
The upper-bound check still passes because len(sharedStrings) > -1 is true.
Excelize then indexes sharedStrings[-1].
This causes a runtime panic.
The issue was reproduced on default branch commit 1213a8bd7c5ab360554603ac5c995ccaf6eb4314.
It was also reproduced on release tag v2.10.1 at commit 5ad5ab3af0054c55bdce09f1530085600e9f2e45.
The affected package is github.com/xuri/excelize/v2.
Tested affected versions include the current default branch and v2.10.1.
No fixed version was known at the time of the report.
An attacker who can provide an XLSX file to an application using Excelize can trigger a panic.
The panic occurs when the application reads the malicious cell through common APIs.
Common APIs include GetCellValue and GetRows.
In services that parse untrusted spreadsheets without panic recovery, this can cause denial of service.
The root cause is in xlsxC.getValueFrom() for shared-string cells with t=”s”.
The code parses the cell value as a shared-string index.
It only checks whether the index is below len(d.SI) before indexing.
For xlsxSI == -1, len(d.SI) > -1 is true.
The code proceeds to index d.SI[-1].
That index is out of range.
The minimal worksheet payload uses a row with cell r=”A1″ t=”s”.
The cell contains -1 .
The workbook also contains a normal sharedStrings.xml with one string, ok.
The failure is specifically due to accepting a negative index.
Calling GetCellValue(“Sheet1”, “A1”) on the workbook panics.
Calling GetRows(“Sheet1”) on the same workbook also panics.
The observed panic is runtime.boundsError: index out of range [-1].
Malformed shared-string indices should be rejected or treated as missing or invalid without panicking.
The suggested remediation checks both lower and upper bounds before indexing.
Regression tests should cover GetCellValue() and GetRows() on t=”s” cells with negative
DailyCVE Form:
Platform: Excelize v2
Version: v2.10.1 commit 1213a8bd
Vulnerability: Negative shared-string index
Severity: Not specified
date: Unknown
Prediction: Unknown
What Undercode Say:
Analytics:
xlsxC.getValueFrom()
xlsxSI, _ := strconv.Atoi(strings.TrimSpace(c.V))
if len(d.SI) > xlsxSI {
return d.SI[bash].String(), nil
}
<?xml version="1.0" encoding="UTF-8"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="1"><c r="A1" t="s"><v>-1</v></c></row> </sheetData> </worksheet>
git clone https://github.com/xuri/excelize.git cd excelize git checkout 1213a8bd7c5ab360554603ac5c995ccaf6eb4314 go test ./...
f, _ := excelize.OpenFile("malicious.xlsx")
_, _ = f.GetCellValue("Sheet1", "A1")
_, _ = f.GetRows("Sheet1")
Exploit: (Educational Purposes!)
<?xml version="1.0" encoding="UTF-8"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="1"><c r="A1" t="s"><v>-1</v></c></row> </sheetData> </worksheet>
f, _ := excelize.OpenFile("malicious.xlsx")
_, _ = f.GetCellValue("Sheet1", "A1")
_, _ = f.GetRows("Sheet1")
Protection: from this CVE
if xlsxSI >= 0 && xlsxSI < len(d.SI) {
return d.SI[bash].String(), nil
}
Add panic recovery.
Validate untrusted XLSX files.
Update Excelize when fixed.
Impact:
Denial of service.
Process panic.
Untrusted spreadsheet parsing.
No panic recovery boundary.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
