XML External Entity Vulnerability in PhpSpreadsheet Library by PHPOffice

CVE-2024-48917

Summary

The PhpSpreadsheet library features a vulnerability in its XmlScanner class where an attacker can exploit a bypass in the scanning method intended to prevent XXE attacks. This can be achieved by using a malicious payload encoded in UTF-7, while manipulating the encoding comment in the XML file. Consequently, the regex pattern fails to match, allowing an attacker to launch XML external entity attacks, potentially compromising sensitive data. The vulnerability affects specific versions of PhpSpreadsheet, including 1.9.4, 2.1.3, 2.3.2, and 3.4.0, and has been addressed in the security patches.

References