CVE-2024-48917: PHPSpreadsheet XXE Vulnerability in XLSX Reader
Summary
CVE-2024-48917: XXE in PHPSpreadsheet's XLSX reader. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.4
>= 2.0.0, < 2.1.3
>= 2.2.0, < 2.3.2
>= 3.3.0, < 3.4.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular library for reading and writing spreadsheet files in PHP. It supports various formats, including XLSX, and is widely used in applications that require data manipulation and reporting. The library provides features such as reading cell data, formatting, and writing to different file types. However, it has been found to be vulnerable to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data or system resources.
Vulnerability Detail
The vulnerability arises from the XmlScanner class in PHPSpreadsheet, specifically in its scan method, which is intended to prevent XXE attacks. A bypass was discovered that allows an attacker to exploit the regex patterns used to determine the encoding of XML files. By crafting a payload with UTF-7 encoding and appending a comment indicating UTF-8 encoding, the attacker can manipulate the XML parsing process. This can lead to unauthorized HTTP requests being made to an attacker-controlled server, potentially exposing sensitive information or allowing further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.41.29.4composer require phpoffice/phpspreadsheet:1.29.4 -
>= 2.0.0, < 2.1.32.1.3composer require phpoffice/phpspreadsheet:2.1.3 -
>= 2.2.0, < 2.3.22.3.2composer require phpoffice/phpspreadsheet:2.3.2 -
>= 3.3.0, < 3.4.03.4.0composer require phpoffice/phpspreadsheet:3.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML files with PHPSpreadsheet until the library is updated. Additionally, ensure that your application does not allow user-uploaded XML files unless they are properly validated and sanitized.
Conclusion
The CVE-2024-48917 vulnerability in PHPSpreadsheet poses a significant risk due to its potential for XXE attacks. It is crucial for developers using this library to update to the latest patched versions to mitigate the risk. Additionally, employing best practices for XML handling can further enhance application security.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data. It can lead to data exposure, denial of service, or server-side request forgery.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your composer.lock file without signing up.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, potential data leaks, and further exploitation of the server hosting the application.
To protect your application, ensure that you validate and sanitize all XML inputs, disable external entity processing in your XML parsers, and keep your dependencies updated.
If you cannot update PHPSpreadsheet right away, implement strict input validation and avoid processing untrusted XML files until the library is updated.
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
