Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ

XXE in PHPSpreadsheet's XLSX reader

Summary

The XmlScanner class has a scan method which should prevent XXE attacks.

However, we found another bypass than the previously reported CVE-2024-47873, the regexes from the findCharSet method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value encoding="UTF-8" with ", which is matched by the first regex, so that encoding='UTF-7' with single quotes ' in the XML header is not matched by the second regex:

 $patterns = [
            '/encoding\\s*=\\s*"([^"]*]?)"/',
            "/encoding\\s*=\\s*'([^']*?)'/",
        ];

A payload for the workbook.xml file can for example be created with CyberChef.
If you open an Excel file containing the payload from the link above stored in the workbook.xml file with PhpSpreadsheet, you will receive an HTTP request on 127.0.0.1:12345. You can test that an HTTP request is created by running the nc -nlvp 12345 command before opening the file containing the payload with PhpSpreadsheet.

To create the payload you need:

  1. Create a file containing <?xml version = "1.0" encoding='UTF-7' in an XML file
  2. Use the link attached above to create your XXE payload and add it to the XML file.
  3. Add +ADw-+ACE---encoding="UTF-8"--+AD4- to the end of the XML file, which is matched by the first regex.

PoC

payload.xlsx

<?php
require 'vendor/autoload.php';

use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Xlsx;

$spreadsheet = new Spreadsheet();

$inputFileType = 'Xlsx';
$inputFileName = './payload.xlsx';

/**  Create a new Reader of the type defined in $inputFileType  **/
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader($inputFileType);
/**  Advise the Reader that we only want to load cell data  **/
$reader->setReadDataOnly(true);

$worksheetData = $reader->listWorksheetInfo($inputFileName);

foreach ($worksheetData as $worksheet) {

$sheetName = $worksheet['worksheetName'];

echo "<h4>$sheetName</h4>";
/**  Load $inputFileName to a Spreadsheet Object  **/
$reader->setLoadSheetsOnly($sheetName);
$spreadsheet = $reader->load($inputFileName);

$worksheet = $spreadsheet->getActiveSheet();
print_r($worksheet->toArray());

}

Impact

An attacker can bypass the sanitizer and achieve an XXE attack.

Permalink: https://github.com/advisories/GHSA-7cc9-j4mv-vcjp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 22 days ago
Updated: 22 days ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00049
EPSS Percentile: 0.19565

Identifiers: GHSA-7cc9-j4mv-vcjp, CVE-2024-48917
References: Repository: https://github.com/PHPOffice/PhpSpreadsheet
Blast Radius: 32.3

Affected Packages

packagist:phpoffice/phpspreadsheet
Dependent packages: 1,063
Dependent repositories: 20,090
Downloads: 203,552,253 total
Affected Version Ranges: >= 3.3.0, < 3.4.0, >= 2.2.0, < 2.3.2, >= 2.0.0, < 2.1.3, < 1.29.4
Fixed in: 3.4.0, 2.3.2, 2.1.3, 1.29.4
All affected versions: 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.14.1, 1.15.0, 1.16.0, 1.17.0, 1.17.1, 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.22.0, 1.23.0, 1.24.0, 1.24.1, 1.25.0, 1.25.1, 1.25.2, 1.26.0, 1.27.0, 1.27.1, 1.28.0, 1.29.0, 1.29.1, 1.29.2, 1.29.3, 2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 3.3.0
All unaffected versions: 1.29.4, 1.29.5, 1.29.6, 2.1.3, 2.1.4, 2.1.5, 2.3.2, 2.3.3, 2.3.4, 3.4.0, 3.5.0, 3.6.0