CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
HighCVSS 8.8
EPSS 1.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpoffice/phpspreadsheet(Packagist) | < 1.8.0 | 1.8.0 |
| phpoffice/phpspreadsheet(Packagist) | = 1.0.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.0.0-beta | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.0.0-beta2 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.1.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.2.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.2.1 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.3.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.3.1 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.4.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.4.1 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.5.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.5.1 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.5.2 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.6.0 | No fix listed |
| phpoffice/phpspreadsheet(Packagist) | = 1.7.0 | No fix listed |
| phpoffice/phpexcel(Packagist) | <= 1.8.2 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.7.9 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.7.9-rc1 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.0 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.0rc1 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.0rc2 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.0rc3 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.0rc4 | No fix listed |
| phpoffice/phpexcel(Packagist) | = 1.8.1 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpoffice/phpexcel(Packagist) | = 1.8.2 | No fix listed |
| phpoffice/phpspreadsheet | < 1.8.0 | 1.8.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com exploit
- github.com product
- github.com third-party-advisory
- github.com
- herolab.usd.de exploit third-party-advisory
- github.com