CVE-2024-45290: PHPSpreadsheet Information Disclosure

CVE-2024-45290 Overview

CVE-2024-45290 is an information disclosure vulnerability in PHPSpreadsheet, a pure PHP library for reading and writing spreadsheet files. An attacker can craft an XLSX file that references media from external URLs. When PHPSpreadsheet opens the file, it retrieves the image size and type by reading the file contents at the supplied path. By substituting a php://filter URL, the attacker can read arbitrary local files or fetch arbitrary remote URLs through the server.

This flaw is tracked under [CWE-36] (Absolute Path Traversal) and is distinct from the previously disclosed GHSA-w9xv-qf98-ccq4. Maintainers have published fixes in 1.29.2, 2.1.1, and 2.3.0.

Critical Impact
Attackers can exfiltrate arbitrary server-side files and request internal URLs, exposing secrets such as AWS IAM credentials from instance metadata endpoints.

Affected Products

PHPOffice PhpSpreadsheet versions prior to 1.29.2
PHPOffice PhpSpreadsheet 2.x prior to 2.1.1
PHPOffice PhpSpreadsheet 2.2.x prior to 2.3.0

Discovery Timeline

2024-10-07 - CVE-2024-45290 published to NVD
2024-10-16 - Last updated in NVD database

Technical Details for CVE-2024-45290

Vulnerability Analysis

PHPSpreadsheet parses media elements embedded in XLSX archives. When an image reference points to a remote location instead of a local file inside the archive, the library reads the resource to determine its size and MIME type. The fetch routine accepts any path that PHP's stream wrappers can resolve, including php://filter, http://, https://, and file://.

An attacker who can submit an XLSX file to a vulnerable application triggers the read on parse. The contents returned by the stream wrapper are processed as image data, but the request itself executes server-side. This enables attackers to coerce the host into reading sensitive files such as /etc/passwd, PHP source through base64 filters, or instance metadata services at 169.254.169.254.

The issue resides in a different component from GHSA-w9xv-qf98-ccq4 but exposes the same class of server-side request and file read primitive.

Root Cause

The media loader does not validate or restrict the scheme of the supplied path before passing it to PHP file functions. Stream wrappers are enabled by default in most PHP builds, so php://filter/convert.base64-encode/resource=... and similar URIs resolve transparently.

Attack Vector

Exploitation requires only that an application accept an attacker-supplied XLSX file and process it with PHPSpreadsheet. No authentication is required when the upload feature is public. The attacker embeds a crafted relationship or drawing entry pointing to a php://filter URL. On parse, the server fetches and processes the resource, and the contents are often surfaced through error messages, logs, or returned image metadata. Even without a return channel, the side effects of the server-side fetch leak data to attacker-controlled endpoints when http(s):// URLs are used.

The vulnerability mechanism is documented in the PHPSpreadsheet Security Advisory GHSA-5gpr-w2p5-6m37.

Detection Methods for CVE-2024-45290

Indicators of Compromise

Outbound HTTP/HTTPS requests originating from PHP-FPM or web worker processes to unexpected destinations, including cloud metadata IPs such as 169.254.169.254.
XLSX uploads whose extracted xl/drawings/_rels/*.rels or media references contain php://, http://, https://, or file:// URIs.
Web server logs showing XLSX uploads followed by anomalous file reads from sensitive paths such as /etc/passwd, /proc/self/environ, or application configuration files.

Detection Strategies

Inspect uploaded XLSX archives for any Target= attribute in relationship files containing stream wrappers or absolute URLs before passing them to the parser.
Alert on PHP processes invoking outbound network connections that are not part of the application's normal egress profile.
Hash and inventory installed PHPSpreadsheet versions across application hosts using software composition analysis to identify versions below the fixed releases.

Monitoring Recommendations

Forward web application and PHP error logs to a centralized analytics platform such as Singularity Data Lake for retroactive hunting against php://filter patterns.
Use Singularity Endpoint behavioral telemetry to identify PHP worker processes reading sensitive files immediately after handling user uploads.
Configure egress firewall rules to log and block connections from application tiers to cloud metadata services and arbitrary external hosts.

How to Mitigate CVE-2024-45290

Immediate Actions Required

Upgrade PHPSpreadsheet to 1.29.2, 2.1.1, or 2.3.0 or later in every application that processes user-supplied spreadsheets.
Audit application logs for prior XLSX uploads containing php://, file://, or external URL references in media relationships.
Rotate any credentials, API keys, or tokens that may have been readable by the web application user, including cloud instance role credentials.

Patch Information

Maintainers addressed the vulnerability in release versions 1.29.2, 2.1.1, and 2.3.0. Update via Composer with composer require phpoffice/phpspreadsheet:^2.3.0 or the equivalent constraint for your release line. Review the GitHub Security Advisory GHSA-5gpr-w2p5-6m37 for full release notes.

Workarounds

No vendor workarounds exist. The maintainers state upgrading is required.
As defense in depth, restrict PHP allow_url_fopen and disable unused stream wrappers in php.ini to reduce the impact of similar issues.
Run the application under a least-privilege OS account and apply IMDSv2 with hop-limit hardening on AWS instances to limit credential exposure.

bash

# Configuration example
composer update phpoffice/phpspreadsheet --with-dependencies
php -r "require 'vendor/autoload.php'; echo \PhpOffice\PhpSpreadsheet\Settings::class;"
# In php.ini, harden stream wrapper usage:
# allow_url_fopen = Off
# disable_functions = ... (review per application needs)