CVE-2024-45290: PhpSpreadsheet Absolute Path Traversal and SSRF Vulnerability
Summary
CVE-2024-45290: PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.2
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.3.0
Fixed in 1.29.2, 2.1.1 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular PHP library used for reading and writing spreadsheet files, including XLSX, CSV, and others. It provides a range of features for manipulating spreadsheet data, making it a valuable tool for developers working with data in PHP applications. However, a recent vulnerability has been identified that allows attackers to exploit the library's handling of external media links in XLSX files, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from PhpSpreadsheet's ability to process external URLs when opening XLSX files. Attackers can craft malicious XLSX files that link to external media, which PhpSpreadsheet retrieves by reading the file contents. By using specially crafted 'php://filter' URLs, an attacker can leak sensitive information from the server or access arbitrary files. This vulnerability is particularly dangerous as it can expose sensitive data, such as AWS IAM credentials, through an error oracle technique that allows attackers to read file contents one character at a time.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.21.29.2composer require phpoffice/phpspreadsheet:1.29.2 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.3.02.3.0composer require phpoffice/phpspreadsheet:2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the loading of external media in PhpSpreadsheet by modifying the code that handles the loading of XLSX files. This can be done by ensuring that any external URLs are not processed or by sanitizing inputs to prevent the use of 'php://filter' URLs. However, upgrading to the fixed version is the recommended approach.
Conclusion
CVE-2024-45290 is a significant vulnerability in the PhpSpreadsheet library that can lead to serious security risks, including unauthorized access to sensitive files and information leakage. It is crucial for users to upgrade to the latest versions of the library to protect their applications from potential exploitation.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-45290 is a vulnerability in the PhpSpreadsheet library that allows for absolute path traversal and server-side request forgery when opening XLSX files.
If your application uses PhpSpreadsheet and processes XLSX files, an attacker could exploit this vulnerability to access sensitive files on your server or leak information from external URLs.
The affected versions are 2.2.0 to 2.2.9 and 0.0.0 to 1.29.1. Users should upgrade to 2.3.0 or 1.29.2 to mitigate the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The CVSS score of CVE-2024-45290 is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
