CVE-2014-3574 in POI
Summary
by MITRE
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/28/2022
Apache POI is a popular java library for processing microsoft office document formats including wordprocessingml and spreadsheetml files. The vulnerability in question affects versions prior to 3.10.1 and 3.11-beta2 where the library fails to properly handle XML entity expansion in OOXML files. This represents a classic XML External Entity vulnerability that allows attackers to craft malicious documents that trigger excessive CPU consumption during parsing. The flaw occurs when the library processes crafted OOXML files containing malformed entity references that cause the XML parser to recursively expand entities, leading to exponential processing time and eventual system resource exhaustion. This vulnerability directly maps to CWE-400 which categorizes excessive resource consumption and CWE-611 which covers improper restriction of XML external entity reference. The attack vector involves delivering a specially crafted OOXML document to a system running vulnerable Apache POI versions, where the parsing process consumes excessive computational resources and may eventually crash the application or system. This type of denial of service attack can be particularly damaging in server environments where multiple documents are processed or in applications that serve as document processing gateways. The operational impact includes potential system unavailability, increased resource consumption, and possible application crashes that disrupt legitimate user operations. Organizations using Apache POI for document processing should immediately upgrade to patched versions that implement proper XML entity validation and limit entity expansion. Additional mitigations include implementing XML parser configurations that disable external entity resolution, employing input validation controls, and deploying network-based protections such as firewalls or intrusion detection systems that can identify and block suspicious document patterns. The vulnerability demonstrates the critical importance of proper XML processing controls in document libraries and highlights how seemingly innocuous file format processing can become a significant security risk when proper input validation is not implemented. This issue also aligns with ATT&CK technique T1499 which covers network denial of service attacks and emphasizes the need for robust input validation in document processing applications to prevent resource exhaustion attacks.