PT-2024-31544 · Unknown · Phpspreadsheet
Emilvirkki
·
Published
2024-10-07
·
Updated
2026-04-29
·
CVE-2024-45291
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHPSpreadsheet versions prior to 1.29.2
PHPSpreadsheet versions prior to 2.1.1
PHPSpreadsheet versions prior to 2.3.0
Description
The issue allows an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer, those files will be included in the output as
data: URLs, regardless of the file's type. Also, URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. An attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if, for example, the expect:// wrapper is enabled, also remote code execution is possible.Recommendations
For PHPSpreadsheet versions prior to 1.29.2, upgrade to version 1.29.2 or later.
For PHPSpreadsheet versions prior to 2.1.1, upgrade to version 2.1.1 or later.
For PHPSpreadsheet versions prior to 2.3.0, upgrade to version 2.3.0 or later.
As a temporary workaround, consider disabling the embedding of images in the HTML writer by setting
$writer->setEmbedImages(false); until a patch is available.
Restrict access to the file get contents() function to minimize the risk of exploitation.
Avoid using the php:// protocol wrapper in the Target attribute of the Relationship element in the xl/drawings/ rels/drawing1.xml.rels file.Exploit
Fix
RCE
SSRF
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Phpspreadsheet