PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Phpoffice |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-3208 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue. |
 Github GHSA |
GHSA-7cc9-j4mv-vcjp | XXE in PHPSpreadsheet's XLSX reader |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 07 Mar 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* |
Mon, 18 Nov 2024 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Phpoffice
Phpoffice phpspreadsheet |
|
| CPEs | cpe:2.3:a:phpoffice:phpspreadsheet:-:*:*:*:*:*:*:* | |
| Vendors & Products |
Phpoffice
Phpoffice phpspreadsheet |
|
| Metrics |
ssvc
|
Mon, 18 Nov 2024 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue. | |
| Title | XXE in PHPSpreadsheet's XLSX reader | |
| Weaknesses | CWE-611 | |
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-11-18T20:15:55.299Z
Reserved: 2024-10-09T22:06:46.172Z
Link: CVE-2024-48917
Vulnrichment
Updated: 2024-11-18T20:15:49.616Z
NVD
Status : Analyzed
Published: 2024-11-18T20:15:05.403
Modified: 2025-03-07T16:48:11.150
Link: CVE-2024-48917
Redhat
No data.
OpenCVE Enrichment
No data.