CVE-2025-31672
📋 TL;DR
This vulnerability allows attackers to create malicious OOXML files (like Excel, Word, or PowerPoint documents) with duplicate zip entries that can cause different applications to interpret the same file differently. It affects any system using Apache POI poi-ooxml library versions before 5.4.0 to parse Office documents. The inconsistency in how duplicate entries are handled could lead to data integrity issues or unexpected behavior.
💻 Affected Systems
- Apache POI poi-ooxml
📦 What is this software?
Poi by Apache
⚠️ Risk & Real-World Impact
Worst Case
Data manipulation or corruption where different systems process the same malicious document differently, potentially leading to incorrect business decisions, data loss, or security bypasses depending on how the parsed data is used.
Likely Case
Inconsistent document processing across different applications or systems, causing data integrity issues, parsing errors, or application crashes when handling specially crafted documents.
If Mitigated
Minimal impact with proper input validation and file scanning; applications would reject or safely handle malformed documents.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious document) or automated document processing systems. No public exploit code has been identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: poi-ooxml 5.4.0
Vendor Advisory: https://poi.apache.org/security.html
Restart Required: No
Instructions:
1. Identify all applications using Apache POI poi-ooxml. 2. Update Maven/Gradle dependencies to poi-ooxml version 5.4.0 or later. 3. Rebuild and redeploy affected applications. 4. Test document processing functionality.
🔧 Temporary Workarounds
Input validation and file scanning
allImplement server-side validation to reject OOXML files with duplicate zip entries before processing.
Use alternative parsing libraries
allTemporarily switch to alternative Office document parsing libraries while upgrading POI.
🧯 If You Can't Patch
- Implement strict file upload validation and scanning for all OOXML documents
- Restrict document processing to trusted sources and implement user awareness training about opening suspicious files
🔍 How to Verify
Check if Vulnerable:
Check your project's dependency management file (pom.xml, build.gradle) for poi-ooxml version. Versions below 5.4.0 are vulnerable.Check Version:
For Maven: mvn dependency:tree | grep poi-ooxml; For Gradle: gradle dependencies | grep poi-ooxmlVerify Fix Applied:
Verify poi-ooxml version is 5.4.0 or higher in dependencies and test parsing of OOXML files with duplicate zip entries (should throw exception).📡 Detection & Monitoring
Log Indicators:
- Exceptions related to zip parsing or duplicate entries in OOXML files
- Unexpected document parsing errors or inconsistencies
Network Indicators:
- Unusual patterns of OOXML file uploads to document processing systems
SIEM Query:
source="application_logs" AND ("duplicate entry" OR "zip entry" OR "OOXML parsing error") AND process="java"