CVE-2023-28151
📋 TL;DR
This vulnerability in Independentsoft JSpreadsheet allows attackers to perform XML External Entity (XXE) injection by uploading a malicious DOCX file containing a remote DTD. This could lead to sensitive file disclosure, server-side request forgery, or denial of service. Organizations using JSpreadsheet versions before 1.1.110 are affected.
💻 Affected Systems
- Independentsoft JSpreadsheet
📦 What is this software?
Jspreadsheet by Independentsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file system access, sensitive data exfiltration, or remote code execution via XXE.
Likely Case
Unauthorized file read from the server, disclosure of configuration files, or internal network scanning via SSRF.
If Mitigated
Limited impact with proper input validation, network segmentation, and file upload restrictions.
🎯 Exploit Status
Exploitation requires file upload capability but no authentication. Standard XXE techniques apply.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.110 and later
Vendor Advisory: https://www.independentsoft.de/jword/index.html
Restart Required: Yes
Instructions:
1. Download JSpreadsheet version 1.1.110 or later from Independentsoft website. 2. Replace existing JSpreadsheet library files. 3. Restart the application server. 4. Test DOCX file processing functionality.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, disallow-doctype-decl=true
Restrict file uploads
allBlock or sanitize DOCX file uploads at the web application level
Implement file type validation and content inspection for uploaded files
🧯 If You Can't Patch
- Implement strict file upload validation to reject DOCX files
- Deploy network segmentation to limit server outbound connections
🔍 How to Verify
Check if Vulnerable:
Check JSpreadsheet library version in application dependencies. If version < 1.1.110, system is vulnerable.Check Version:
Check JSpreadsheet JAR file manifest or dependency configuration (e.g., Maven pom.xml, Gradle build.gradle)Verify Fix Applied:
After updating, test with a safe DOCX file containing XXE payloads to confirm they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- XML parsing errors
- Outbound connections to unusual domains during file processing
Network Indicators:
- HTTP requests to external DTD URLs from application server
- Unusual outbound traffic patterns after file upload
SIEM Query:
source="application_logs" AND ("DOCX upload" OR "XML parse error") AND dest_ip NOT IN (allowed_ips)