CVE-2024-45293: PHPSpreadsheet XXE Vulnerability in XLSX Reader
Summary
CVE-2024-45293: XXE in PHPSpreadsheet's XLSX reader. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.1
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.3.0
Fixed in 1.29.1, 2.1.1 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular library for reading and writing spreadsheet files in PHP. It supports various formats, including XLSX, and is widely used in applications that require data manipulation and reporting. The library's XLSX reader is designed to parse Excel files, but it has a critical vulnerability that allows for XML External Entity (XXE) attacks, potentially exposing sensitive information on servers that permit user-uploaded Excel sheets.
Vulnerability Detail
The vulnerability arises from a flawed XML encoding check in the XML scanner of PHPSpreadsheet's XLSX reader. Specifically, the regex used to identify the XML encoding can be bypassed by introducing whitespace around the '=' character in the encoding attribute. This allows an attacker to craft a malicious XLSX file that, when parsed, can lead to the disclosure of sensitive server files and information. The XXE payload can be executed by manipulating the XML structure, which can escalate to information disclosure or file read vulnerabilities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.11.29.1composer require phpoffice/phpspreadsheet:1.29.1 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.3.02.3.0composer require phpoffice/phpspreadsheet:2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the parsing of external entities in your XML processing logic. This can be done by modifying the XML scanner settings or by sanitizing the input files before processing them. However, this is not a complete solution and should only be used until the library is updated.
Conclusion
The XXE vulnerability in PHPSpreadsheet's XLSX reader poses a significant risk to applications that allow user-uploaded Excel files. It is crucial to update to the latest versions of the library to mitigate this risk. Additionally, implementing workarounds and monitoring tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
XXE (XML External Entity) vulnerability allows an attacker to interfere with the processing of XML data, potentially leading to sensitive data exposure or server-side request forgery.
If your application uses PHPSpreadsheet versions prior to 2.3.0 or 1.29.1 and allows user-uploaded XLSX files, it is likely affected by this vulnerability.
The potential impacts include unauthorized access to sensitive files on the server, data leakage, and possible escalation of privileges depending on the server configuration.
You can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities without requiring access to the code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
