PT-2024-31546 · Unknown · Phpspreadsheet

0Xshade + 2 · Published 2024-10-07 · Updated 2025-03-07 · CVE-2024-45293

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.1 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0

Description The security scanner in PHPSpreadsheet's XLSX reader can be bypassed by modifying the XML structure using white-spaces, allowing for sensitive information disclosure through XXE attacks on servers that permit users to upload their own Excel sheets. The toUtf8 function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check, defaulting to UTF-8 encoding if the encoding is not found, which can be exploited by passing a UTF-7 encoded XXE payload. This issue can be used to disclose server files and sensitive information by providing a crafted Excel sheet.

Recommendations For PHPSpreadsheet versions prior to 1.29.1, upgrade to version 1.29.1 or later. For PHPSpreadsheet versions prior to 2.1.1, upgrade to version 2.1.1 or later. For PHPSpreadsheet versions prior to 2.3.0, upgrade to version 2.3.0 or later. As a temporary workaround, consider restricting the upload of Excel sheets or disabling the use of PHPSpreadsheet's Excel parser until a patch is applied.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-45293

GHSA-6HWR-6V2F-3M88

Affected Products

Phpspreadsheet

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45293.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hwr-6v2f-3m88 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45293 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45293 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/7d6cb09f6e8204f65e6dd5a0490f7f45f44bb331 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/949ff63e1f6413e6485f73af012d506aa81384bf · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/3bcd51826b7f089d1641e756c83030c30c3bdb0c · Note
• https://t.me/cvenotify/113857 · Telegram Post
• https://t.me/cvedetector/7265 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1843442194188779534 · Twitter Post
• https://twitter.com/CVEnew/status/1843390999319720045 · Twitter Post