XmlScanner bypass leads to XXE
Summary
The XmlScanner class has a scan method which should prevent XXE attacks.
However, the regexes used in the scan method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing as described in https://www.w3.org/TR/xml/#sec-guessing-no-ext-info.
Details
The scan method converts the input in the UTF-8 encoding if it is not already in the UTF-8 encoding with the toUtf8 method.
Then, the scan method uses a regex which would also work with 16-bit encoding.
However, the regexes from the findCharSet method, which is used for determining the current encoding can be bypassed by using an encoding which has more than 8 bits, since the regex does not expect null bytes, and the XML library will also autodetect the encoding as described in https://www.w3.org/TR/xml/#sec-guessing-no-ext-info.
A payload for the workbook.xml file can for example be created with CyberChef.
If you open an Excel file containing the payload from the link above stored in the workbook.xml file with PhpSpreadsheet, you will receive an HTTP request on 127.0.0.1:12345. You can test that an HTTP request is created by running the nc -nlvp 12345 command before opening the file containing the payload with PhpSpreadsheet.
PoC
- Create a new folder.
- Run the
composer require phpoffice/phpspreadsheetcommand in the new folder. - Create an
index.phpfile in that folder with the following content:
<?php
require 'vendor/autoload.php';
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Xlsx;
$spreadsheet = new Spreadsheet();
$inputFileType = 'Xlsx';
$inputFileName = './payload.xlsx';
/** Create a new Reader of the type defined in $inputFileType **/
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader($inputFileType);
/** Advise the Reader that we only want to load cell data **/
$reader->setReadDataOnly(true);
$worksheetData = $reader->listWorksheetInfo($inputFileName);
foreach ($worksheetData as $worksheet) {
$sheetName = $worksheet['worksheetName'];
echo "<h4>$sheetName</h4>";
/** Load $inputFileName to a Spreadsheet Object **/
$reader->setLoadSheetsOnly($sheetName);
$spreadsheet = $reader->load($inputFileName);
$worksheet = $spreadsheet->getActiveSheet();
print_r($worksheet->toArray());
}- Run the following command:
php -S 127.0.0.1:8080 - Add the payload.xlsx file, which contains a payload similar to the payload from the details section, but with the URL
https://webhook.site/65744200-63d2-43a2-a6a0-cca8d6b0d50ainstead of thehttp://127.0.0.1:12345/ext.dtdURL, in the folder and open https://127.0.0.1:8080 in a browser. You will see an HTTP request on https://webhook.site/#!/view/65744200-63d2-43a2-a6a0-cca8d6b0d50a.
Impact
An attacker can bypass the sanitizer and achieve an XXE attack.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | phpoffice/phpexcel | <= 1.8.2 | no fix |
| Composer package | phpoffice/phpspreadsheet | < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
References
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w
- https://nvd.nist.gov/vuln/detail/CVE-2024-47873
- https://github.com/PHPOffice/PhpSpreadsheet
- https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- https://www.w3.org/TR/xml/#sec-guessing-no-ext-info
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-611- Platform
- Composer
- Package
phpoffice/phpexcel, phpoffice/phpspreadsheet- Disclosed
- 18.11.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jw4x-v69f-hh5w - CC BY 4.0
Vulnerability history: phpoffice/phpexcel
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 23
- First → latest
- 11.2019 02.2025
- Without a fix
- 20
- Exploited in attacks
- 0
Severity breakdown
- High 12
- Medium 10
- Low 1
Disclosures per year
- 2019: 2
- 2020: 0
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 10
- 2025: 9
- 2026: 0
-
XmlScanner bypass leads to XXE this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.