Images Embedding Vulnerability in PHPSpreadsheet

CVE-2024-45291

Summary

PHPSpreadsheet, a well-known PHP library for handling spreadsheet files, has a security flaw that allows attackers to exploit the image embedding feature. When the HTML writer's embedding of images is enabled, attackers can create corrupted XLSX files linking images from arbitrary server paths. This process results in the inclusion of files as 'data:' URLs in the output. The vulnerability also permits attackers to execute arbitrary HTTP GET requests by embedding URLs, thus risking the exposure of sensitive files on the server. Notably, PHP protocol wrappers can be utilized in this attack vector, potentially leading to remote code execution if certain wrappers, like 'expect://', are enabled. Upgrading to newer releases, specifically versions 1.29.2, 2.1.1, and 2.3.0, is essential as there are no workarounds available for this vulnerability.

References