PT-2018-14898 · Phpoffice · Phpoffice Phpspreadsheet

CVE-2018-19277 · Published 2018-11-14 · Updated 2024-09-04

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPOffice PhpSpreadsheet versions prior to 1.5.1

Description The issue allows a bypass of protection mechanisms for XML External Entity (XXE) attacks via UTF-7 encoding in a .xlsx file. This is achieved through the securityScan() function in PHPOffice PhpSpreadsheet.

Recommendations For PHPOffice PhpSpreadsheet versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. As a temporary workaround, consider disabling the securityScan() function until a patch is available. Restrict access to .xlsx files to minimize the risk of exploitation. Avoid using UTF-7 encoding in .xlsx files until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2018-19277

GHSA-XCRG-29H7-H4CJ

Affected Products

Phpoffice Phpspreadsheet

References · 16

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/issues/771 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml · Exploit
• 🔥 https://exploit-db.com/exploits/46050 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19277 · Security Note
• https://osv.dev/vulnerability/GHSA-xcrg-29h7-h4cj · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/pull/780 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1 · Note
• https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095 · Note
• https://github.com/PHPOffice/PHPExcel/commits/1.8.2 · Note
• https://github.com/MewesK/TwigSpreadsheetBundle/issues/18 · Note
• https://drupal.org/sa-contrib-2021-043 · Note
• https://bishopfox.com/news/2018/11/phpoffice-versions · Note