CVE-2015-3542: PHPExcel XXE Vulnerability - XML External Entity Injection Risk
Summary
CVE-2015-3542: PHPExcel XXE Vulnerability. Affects phpoffice/phpexcel versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPExcel is a popular open-source library for reading and writing spreadsheet files in PHP. It allows developers to create, read, and manipulate Excel files in various formats. The library is widely used in applications that require data export and import functionalities. However, it has been found to be vulnerable to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data and system resources.
Vulnerability Detail
The XXE vulnerability in PHPExcel arises from improper handling of XML input. Attackers can exploit this flaw by crafting malicious XML documents that include external entities. When PHPExcel processes these documents, it may inadvertently disclose sensitive information from the server or perform unauthorized actions. This vulnerability is classified under CWE-611, which pertains to improper restriction of XML external entity reference. The potential ramifications include data leakage, denial of service, and further exploitation of the underlying system.
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
composer require phpoffice/phpexcel:1.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to disable the loading of external entities in the XML parser. This can be done by modifying the XML loading settings in your code. Here is an example of how to do this in PHP:
libxml_disable_entity_loader(true);
This setting should be applied before loading any XML data with PHPExcel.
Conclusion
The PHPExcel XXE vulnerability (CVE-2015-3542) poses significant risks to applications using this library. It is crucial for developers to update to the patched version (1.8.1 or later) to mitigate these risks. For those unable to upgrade immediately, implementing the suggested workaround can provide temporary protection.
See every vulnerability recorded for phpoffice/phpexcel →
FAQ
XXE (XML External Entity) vulnerability allows attackers to interfere with the processing of XML data, potentially leading to data exposure or system compromise.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Consequences can include unauthorized access to sensitive files, denial of service, and the ability to execute arbitrary code on the server.
Yes, you can disable external entity loading in the XML parser as a temporary workaround until you can upgrade.
You can find more information about PHPExcel on its official GitHub repository or documentation site.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpexcel.
