CVE-2024-47873: PhpSpreadsheet XML Scanner Bypass Leading to XXE Vulnerability
Summary
CVE-2024-47873: XmlScanner bypass leads to XXE. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.4
>= 2.0.0, < 2.1.3
>= 2.2.0, < 2.3.2
>= 3.3.0, < 3.4.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It supports various file formats, including Excel and CSV, and is widely used in applications that require data manipulation and reporting. The library's XmlScanner class is designed to ensure the security of XML processing by preventing XML External Entity (XXE) attacks. However, a vulnerability has been identified that allows attackers to bypass these security measures, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from the XmlScanner class's scan method, which is intended to prevent XXE attacks. The regex patterns used in this method can be bypassed through the use of UCS-4 encoding and encoding guessing techniques. This flaw allows attackers to craft malicious XML payloads that can exploit the library's XML processing capabilities, leading to potential data exfiltration or unauthorized access to internal resources. The vulnerability is classified under CWE-611, indicating improper restriction of XML external entity reference.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.41.29.4composer require phpoffice/phpspreadsheet:1.29.4 -
>= 2.0.0, < 2.1.32.1.3composer require phpoffice/phpspreadsheet:2.1.3 -
>= 2.2.0, < 2.3.22.3.2composer require phpoffice/phpspreadsheet:2.3.2 -
>= 3.3.0, < 3.4.03.4.0composer require phpoffice/phpspreadsheet:3.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML files with PhpSpreadsheet until the package is updated. Additionally, consider implementing input validation and sanitization to mitigate the risk of XXE attacks.
Conclusion
The CVE-2024-47873 vulnerability in PhpSpreadsheet poses a significant risk due to its potential for XXE attacks. Users are strongly advised to update to the latest patched versions of the library to mitigate this risk. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-47873 is a vulnerability in the PhpSpreadsheet library that allows attackers to bypass XML security measures, potentially leading to XXE attacks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
The vulnerability can lead to unauthorized access to sensitive data, data exfiltration, and exploitation of internal resources through crafted XML payloads.
You can update PhpSpreadsheet by running the command: composer update phpoffice/phpspreadsheet in your project directory.
An XML External Entity (XXE) attack exploits vulnerabilities in XML parsers to access internal files or services, potentially leading to data breaches.
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
