CVE-2024-45293·PHP vulnerability
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Severity
- high
- Software
- PHP
- Fixed in
- 2.3.0
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 2.8% — higher than 85% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 2.2.0
Until: 2.3.0
Fixed in: 2.3.0
How to fix this CVE
Update PHPSpreadsheet to version 2.3.0 or later to patch the XML encoding bypass vulnerability that allows XXE attacks through specially crafted XLSX files. If your application uses PHPSpreadsheet for processing user-uploaded Excel files, prioritize this update immediately as attackers can extract sensitive server files and configuration data. Verify the library version in your composer.lock or vendor directory and run composer update to pull the patched release.
sudo dnf update php php-cli php-commonDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST requests uploading .xlsx files with XML declaration containing encoding attribute with whitespace before or after the equals sign (e.g., encoding = "UTF-7"|encoding= 'UTF-7') followed by XXE payload markupWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Block XLSX file uploads containing XML encoding declarations with non-standard whitespace patterns. Implement content-type validation for Excel uploads and restrict processing to known-safe versions of PHPSpreadsheet via application-level version pinning.How to check if you are affected
- Check PHPSpreadsheet version: grep -r '"version"' vendor/phpoffice/phpspreadsheet/composer.json or composer show phpoffice/phpspreadsheet
- Verify if your application accepts user-uploaded XLSX files by searching the codebase for PHPSpreadsheet Reader instantiation: grep -r 'IOFactory::load\|Xlsx' src/
- Review web server logs for suspicious XLSX upload requests with unusual encoding attributes: grep -i 'xlsx\|spreadsheet' /var/log/apache2/access.log | grep -i 'post'
- Confirm the fix by re-running composer show phpoffice/phpspreadsheet and verifying the version is 2.3.0 or later, then restart PHP-FPM: sudo systemctl restart php-fpm
Indicators of compromise
- XLSX files with XML encoding declarations using whitespace around the = character
- POST requests to file upload endpoints with Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet containing XXE payloads
FAQ
What is CVE-2024-45293?
CVE-2024-45293 is an XML External Entity (XXE) injection vulnerability in PHPSpreadsheet's XLSX parser that can be triggered by manipulating XML encoding declarations with whitespace characters. An attacker can bypass the built-in XXE security scanner and read sensitive files from the server by uploading a maliciously crafted Excel spreadsheet.
Is CVE-2024-45293 being actively exploited?
No, CVE-2024-45293 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been disclosed, though the vulnerability is trivial to exploit on unpatched systems.
What versions of PHP are affected by CVE-2024-45293?
CVE-2024-45293 affects PHPSpreadsheet versions 2.2.0 through 2.3.0 (exclusive). The vulnerability has been patched in version 2.3.0 and earlier supported branches 1.29.1 and 2.1.1.
How do I check if my server is vulnerable to CVE-2024-45293?
Run: composer show phpoffice/phpspreadsheet | grep Version; if the version is between 2.2.0 and 2.2.x, your server is vulnerable. Additionally, check if your application processes user-uploaded XLSX files by searching your codebase for Xlsx reader usage.
Does Defensia detect CVE-2024-45293?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHPSpreadsheet is installed on a monitored server, CVE-2024-45293 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-45293. Free for 1 server.
Get started free