CVE-2019-12331: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
Summary
CVE-2019-12331: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue. Affects phpoffice/phpspreadsheet versions < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a PHP library that allows developers to read, write, and manipulate spreadsheet files in various formats, including Excel. It provides a wide range of functionalities for creating and editing spreadsheets, making it a popular choice for PHP developers. However, a vulnerability has been discovered in versions prior to 1.8.0 that allows for XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability in PHPSpreadsheet arises from an incomplete fix for a previous encoding issue (CVE-2018-19277). The XmlScanner, responsible for decoding the sheet1.xml file from an .xlsx file, converts it to UTF-8 if a different encoding is declared in the header. This was implemented as a security measure to prevent the previous vulnerability, but the fix is not sufficient. By double-encoding the XML payload to UTF-7, it becomes possible to bypass the check for the string '?<!ENTITY?' and execute an XXE attack. This can lead to unauthorized access to sensitive data, denial of service, or other malicious activities.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
composer require phpoffice/phpspreadsheet:1.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of PHPSpreadsheet to mitigate the risk of XXE attacks.
Conclusion
The XXE vulnerability in PHPSpreadsheet versions prior to 1.8.0 can be exploited to execute malicious XML External Entity attacks. To mitigate this risk, it is crucial to update to the fixed version of PHPSpreadsheet (1.8.0 or later). Vulert's playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
PHPSpreadsheet is a PHP library that allows developers to read, write, and manipulate spreadsheet files in various formats, including Excel.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. It allows an attacker to read local files, perform remote requests, or execute arbitrary code by including external entities in XML documents.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available in PHPSpreadsheet version 1.8.0 and later. It is recommended to update your dependencies to the latest version to ensure the vulnerability is patched.
This vulnerability can lead to unauthorized access to sensitive data, denial of service, or other malicious activities. It is important to address this vulnerability promptly to protect your application and its users.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
