CVE-2023-46345
📋 TL;DR
Catdoc v0.95 contains a NULL pointer dereference vulnerability in the xls2csv component that can cause the application to crash when processing malicious Excel files. This affects systems running Catdoc v0.95 to convert Excel files to CSV format. The vulnerability could potentially lead to denial of service or be leveraged for further exploitation.
💻 Affected Systems
- Catdoc
📦 What is this software?
Catdoc by Fossies
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if combined with other vulnerabilities, or persistent denial of service affecting file conversion services
Likely Case
Application crash when processing specially crafted Excel files, causing denial of service for file conversion operations
If Mitigated
Application crash with no data loss or privilege escalation if proper sandboxing and privilege separation are implemented
🎯 Exploit Status
Proof of concept available in GitHub gist, exploitation requires feeding malicious Excel file to xls2csv
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or apply source code fix from community patches.
🔧 Temporary Workarounds
Disable xls2csv component
linuxRemove or disable the xls2csv binary to prevent exploitation
sudo rm /usr/bin/xls2csv
sudo chmod 000 /usr/bin/xls2csv
Input validation wrapper
linuxCreate a wrapper script that validates Excel files before passing to xls2csv
#!/bin/bash
# Validate file exists and is not empty before processing
if [ -s "$1" ]; then
/usr/bin/xls2csv "$1"
else
echo "Invalid or empty file"
exit 1
fi
🧯 If You Can't Patch
- Implement strict file upload validation for any Excel files processed by Catdoc
- Run Catdoc in a containerized or sandboxed environment with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check if xls2csv binary exists and version is 0.95: xls2csv --version 2>&1 | grep -i 'catdoc'Check Version:
xls2csv --version 2>&1 | head -1Verify Fix Applied:
Test with known malicious Excel file from PoC to ensure application doesn't crash📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in system logs
- Catdoc/xls2csv process crashes
- Abnormal termination of file conversion processes
Network Indicators:
- Multiple failed file conversion requests
- Unusual Excel file upload patterns to conversion services
SIEM Query:
process.name:"xls2csv" AND event.action:"segmentation_fault"