XML External Entity Vulnerability in PhpSpreadsheet Library by PHPOffice

CVE-2024-48917

What is CVE-2024-48917?

The PhpSpreadsheet library features a vulnerability in its XmlScanner class where an attacker can exploit a bypass in the scanning method intended to prevent XXE attacks. This can be achieved by using a malicious payload encoded in UTF-7, while manipulating the encoding comment in the XML file. Consequently, the regex pattern fails to match, allowing an attacker to launch XML external entity attacks, potentially compromising sensitive data. The vulnerability affects specific versions of PhpSpreadsheet, including 1.9.4, 2.1.3, 2.3.2, and 3.4.0, and has been addressed in the security patches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References