CVE-2024-45293: PHPSpreadsheet XXE Vulnerability

CVE-2024-45293 Overview

CVE-2024-45293 is an XML External Entity (XXE) vulnerability in PHPSpreadsheet, a pure PHP library for reading and writing spreadsheet files. The library's XLSX reader includes a security scanner intended to block XXE payloads, but attackers can bypass it by inserting whitespace around the XML encoding attribute. This bypass allows a UTF-7 encoded XXE payload to reach the parser, enabling disclosure of server files and sensitive data when an application accepts user-supplied spreadsheets. The flaw is tracked as [CWE-611] Improper Restriction of XML External Entity Reference.

Critical Impact

Remote, unauthenticated attackers can read arbitrary server files by uploading a crafted XLSX containing a UTF-7 XXE payload that evades PHPSpreadsheet's XmlScanner checks.

Affected Products

• PHPOffice PhpSpreadsheet versions prior to 1.29.1
• PHPOffice PhpSpreadsheet 2.x prior to 2.1.1
• PHPOffice PhpSpreadsheet 2.2.x prior to 2.3.0

Discovery Timeline

• 2024-10-07 - CVE-2024-45293 published to the National Vulnerability Database
• 2025-03-07 - Last updated in NVD database

Technical Details for CVE-2024-45293

Vulnerability Analysis

The vulnerability resides in src/PhpSpreadsheet/Reader/Security/XmlScanner.php, specifically the toUtf8 function responsible for normalizing XML input prior to scanning. The function uses a regular expression to detect the declared XML encoding by searching for encoding="*" or encoding='*'. When no match is found, the scanner assumes UTF-8 and skips the conversion step that would otherwise neutralize alternate encodings.

An attacker who inserts a single whitespace character before or after the = in the encoding attribute defeats the regex. The scanner then bypasses encoding conversion, while the downstream XML parser still honors the declared encoding. This mismatch lets a UTF-7 encoded <!DOCTYPE> declaration with an external entity reference pass through unmodified.

Successful exploitation discloses local files such as /etc/passwd, application source code, or configuration secrets through standard XXE primitives. Confidentiality impact is high; the issue does not directly affect integrity or availability.

Root Cause

The root cause is a flawed encoding detection regex in XmlScanner::toUtf8 that does not tolerate the whitespace permitted by the XML specification around attribute equals signs. The detection logic is also too narrow — it fails open by defaulting to UTF-8 instead of refusing to process unrecognized declarations. This violates the defense-in-depth assumption that all input is normalized before scanning for <!ENTITY> and SYSTEM references.

Attack Vector

Exploitation requires the target application to accept user-uploaded XLSX files and parse them with PHPSpreadsheet. The attacker crafts an XLSX archive whose internal XML parts declare encoding = "UTF-7" with a whitespace-padded attribute. The XML body contains a UTF-7 encoded external entity declaration referencing a local file or attacker-controlled URL. When the server parses the spreadsheet, the entity resolves and the file contents are returned through cell data or error messages.

The vulnerability manifests in the toUtf8 encoding detection routine of XmlScanner.php. See the PHPOffice security advisory GHSA-6hwr-6v2f-3m88 for full technical details and the corrected regular expression.

Detection Methods for CVE-2024-45293

Indicators of Compromise

• Uploaded XLSX files whose internal XML parts contain encoding declarations with surrounding whitespace, such as encoding ="UTF-7" or encoding= 'UTF-7'.
• UTF-7 encoded substrings inside XLSX XML parts, notably +ADw- sequences that decode to <!DOCTYPE or <!ENTITY markup.
• Outbound HTTP or DNS requests from PHP application servers immediately after spreadsheet uploads, indicating external entity resolution.
• PHP error logs referencing libxml entity loading or unexpected file reads triggered by PHPSpreadsheet processes.

Detection Strategies

• Inspect XLSX uploads in transit by unzipping the archive and scanning embedded XML for non-UTF-8 encoding declarations and DOCTYPE blocks.
• Hunt in process telemetry for PHP-FPM or Apache workers reading sensitive paths such as /etc/passwd, /proc/self/environ, or application secret files shortly after a file upload.
• Correlate web access logs of spreadsheet upload endpoints with egress connections from the same worker process within a short time window.

Monitoring Recommendations

• Enable libxml entity loader logging in PHP and alert on any external entity resolution from web-facing workloads.
• Monitor the installed version of phpoffice/phpspreadsheet across hosts via software inventory and flag versions below 1.29.1, 2.1.1, or 2.3.0.
• Capture and retain uploaded XLSX samples for retroactive scanning when new XXE bypass techniques are disclosed.

How to Mitigate CVE-2024-45293

Immediate Actions Required

• Upgrade phpoffice/phpspreadsheet to 1.29.1, 2.1.1, or 2.3.0 or later using Composer across all application environments.
• Audit application code for any direct calls to IOFactory::load() or XLSX reader instances and confirm the patched version is loaded at runtime.
• Restrict file upload endpoints to authenticated users and validate the MIME type and structure of submitted spreadsheets before parsing.
• Run the PHP-FPM worker under a least-privilege account that cannot read sensitive configuration or credential files.

Patch Information

The maintainers fixed the encoding detection logic in PHPSpreadsheet releases 1.29.1, 2.1.1, and 2.3.0. The patched XmlScanner::toUtf8 regex now tolerates whitespace around the encoding attribute and correctly identifies non-UTF-8 declarations before scanning. Full details are available in the PHPOffice GitHub Security Advisory GHSA-6hwr-6v2f-3m88.

Workarounds

• No vendor-supplied workarounds exist; upgrading is the only supported remediation per the advisory.
• As a compensating control, disable XLSX upload functionality until the patched library is deployed.
• Apply egress filtering on application servers to block outbound connections that XXE payloads rely on for data exfiltration.

# Configuration example
composer require phpoffice/phpspreadsheet:^2.3.0
composer show phpoffice/phpspreadsheet | grep versions