CVE-2018-19277: XXE in PHPSpreadsheet due to encoding issue
Summary
CVE-2018-19277: XXE in PHPSpreadsheet due to encoding issue. Affects phpoffice/phpspreadsheet versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular PHP library used for reading and writing spreadsheet files. It provides a wide range of functionality for manipulating Excel files. However, versions up to 1.5.0 are vulnerable to an XML External Entity (XXE) attack due to an encoding issue. This vulnerability allows an attacker to bypass protection mechanisms and exploit the application by using UTF-7 encoding in a .xlsx file.
Vulnerability Detail
The securityScan() function in PHPOffice PhpSpreadsheet through version 1.5.0 is susceptible to an XXE attack. By utilizing UTF-7 encoding in a specially crafted .xlsx file, an attacker can bypass protection mechanisms and gain unauthorized access to sensitive information. This vulnerability has a high severity rating (CVSS score: 8.8) and can lead to data leakage, denial of service, or remote code execution.
How To Fix
Minimum fixed version
1.5.1
This is the first release that contains the fix.
composer require phpoffice/phpspreadsheet:1.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to disable the processing of external entities in the affected application's XML parser. This can be achieved by modifying the XML parser settings to disallow the resolution of external entities. Here is an example of how to disable external entity resolution in PHP:
$disableEntities = libxml_disable_entity_loader(true);
This workaround should only be considered as a temporary solution until the package is updated.
Conclusion
The XXE vulnerability in PHPSpreadsheet poses a significant risk to applications utilizing this library. It is crucial to update the package to version 1.5.0 or later to mitigate the vulnerability. If immediate updating is not possible, consider applying the temporary workaround of disabling external entity resolution. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
PHPSpreadsheet is a PHP library that allows developers to read, write, and manipulate spreadsheet files, including Excel files. It provides a wide range of functionality for working with spreadsheet data.
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to exploit an XML parser's functionality to read arbitrary files or execute remote requests. In this case, the XXE attack is possible due to an encoding issue in PHPSpreadsheet.
This vulnerability can lead to unauthorized access to sensitive information, data leakage, denial of service, or even remote code execution. It is crucial to update the PHPSpreadsheet package to mitigate the risk.
To update the PHPSpreadsheet package, you can use Composer, a dependency management tool for PHP. Run the following command in your project's root directory: composer update phpoffice/phpspreadsheet
Yes, if updating the package is not immediately feasible, you can temporarily disable the processing of external entities in the XML parser. However, this should only be considered as a temporary solution until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
