PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.
References
Link | Resource |
---|---|
https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01 | Third Party Advisory |
https://herolab.usd.de/security-advisories/usd-2019-0046/ | Exploit Third Party Advisory |
Configurations
History
04 Sep 2024, 17:45
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | |
First Time |
Phpoffice
Phpoffice phpspreadsheet |
Information
Published : 2019-11-07 15:15
Updated : 2024-09-04 17:45
NVD link : CVE-2019-12331
Mitre link : CVE-2019-12331
CVE.ORG link : CVE-2019-12331
JSON object : View
Products Affected
phpoffice
- phpspreadsheet
CWE
CWE-611
Improper Restriction of XML External Entity Reference