CVE-2014-2054: XXE vulnerability in PHPExcel
Summary
CVE-2014-2054: PHPExcel vulnerable to XXE attacks through libxml. Affects phpoffice/phpexcel versions < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPExcel is a PHP library for reading and writing spreadsheet files, such as Excel. It is commonly used in various applications and frameworks, including ownCloud Server. The library provides functionality to manipulate spreadsheet data and generate Excel files. However, prior to version 1.8.0, PHPExcel is vulnerable to XML External Entity (XXE) attacks through libxml.
Vulnerability Detail
The vulnerability in PHPExcel arises from the failure to disable external entity loading in libxml. This allows remote attackers to exploit XML External Entity (XXE) attacks, which can lead to various security issues. An attacker can leverage this vulnerability to read arbitrary files, cause a denial of service, or potentially achieve other impacts. This vulnerability is rated as MODERATE severity according to the Common Vulnerability Scoring System (CVSS).
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
composer require phpoffice/phpexcel:1.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
PHPExcel versions prior to 1.8.0 are vulnerable to an XXE attack through libxml. To mitigate this vulnerability, users should update PHPExcel to version 1.8.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpoffice/phpexcel →
FAQ
PHPExcel is a PHP library for reading and writing spreadsheet files, such as Excel. It provides functionality to manipulate spreadsheet data and generate Excel files.
An XML External Entity (XXE) attack is a type of vulnerability that allows an attacker to exploit the processing of XML input. By including external entities in XML documents, an attacker can read arbitrary files, cause a denial of service, or potentially achieve other impacts.
The vulnerability in PHPExcel allows remote attackers to exploit XXE attacks, potentially leading to the reading of arbitrary files, denial of service, or other impacts.
To fix this vulnerability, update PHPExcel to version 1.8.0 or later. This version includes the necessary changes to disable external entity loading in libxml.
No specific workaround is provided for this vulnerability. It is recommended to update PHPExcel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpexcel.
