CVE-2024-45291: PhpSpreadsheet Path Traversal and SSRF Vulnerability in HTML Writer
Summary
CVE-2024-45291: It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.2
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.3.0
Fixed in 1.29.2, 2.1.1 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PhpSpreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It supports various formats, including XLSX, and is widely used for generating reports and data manipulation. The library allows users to embed images in spreadsheets, which is a key feature for enhancing the visual presentation of data. However, a significant vulnerability has been identified that allows attackers to exploit the image embedding functionality, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to create a malicious XLSX file that links images from arbitrary paths. When the HTML writer's image embedding feature is enabled, the library includes these images in the output as data URLs without validating the file paths. This can lead to absolute path traversal, allowing attackers to read sensitive files on the server, such as '/etc/passwd'. Additionally, attackers can use URLs for embedding images, resulting in a Server-Side Request Forgery (SSRF) vulnerability, which can be exploited to make arbitrary HTTP GET requests from the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.21.29.2composer require phpoffice/phpspreadsheet:1.29.2 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.3.02.3.0composer require phpoffice/phpspreadsheet:2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, users can disable the embedding of images in the HTML writer by setting '$writer->
setEmbedImages(false);
'. This will prevent the inclusion of potentially malicious images in the output.
Conclusion
The CVE-2024-45291 vulnerability in PhpSpreadsheet poses significant risks due to its potential for path traversal and SSRF attacks. Users are strongly advised to upgrade to the latest versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-45291 is a vulnerability in PhpSpreadsheet that allows for absolute path traversal and Server-Side Request Forgery when embedding images in HTML output.
If your application uses PhpSpreadsheet with image embedding enabled, an attacker could exploit this vulnerability to read sensitive files on your server or perform unauthorized HTTP requests.
Versions prior to 2.3.0 for the 2.x series and prior to 1.29.2 for the 1.x series are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
