CVE-2024-47873 Overview
CVE-2024-47873 is an XML External Entity (XXE) vulnerability in PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files. The XmlScanner class exposes a scan method intended to block XXE payloads before XML parsing. Attackers can bypass the regex-based sanitization in both scan and findCharSet by submitting documents encoded in UCS-4, which the scanner's character set detection fails to handle. Successful exploitation allows external entity resolution during spreadsheet ingestion, enabling unauthenticated remote attackers to read sensitive files from the server. The issue is fixed in versions 1.29.4, 2.1.3, 2.3.2, and 3.4.0.
Critical Impact
Unauthenticated remote attackers can bypass the XXE sanitizer using UCS-4 encoded payloads to disclose sensitive files via XML external entity processing [CWE-611].
Affected Products
- PhpOffice PhpSpreadsheet versions prior to 1.29.4
- PhpOffice PhpSpreadsheet 2.x prior to 2.1.3 and 2.3.x prior to 2.3.2
- PhpOffice PhpSpreadsheet 3.x prior to 3.4.0
Discovery Timeline
- 2024-11-18 - CVE-2024-47873 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47873
Vulnerability Analysis
The vulnerability resides in the XmlScanner::scan and XmlScanner::findCharSet methods within src/PhpSpreadsheet/Reader/Security/XmlScanner.php. These methods use regular expressions to detect dangerous XML constructs such as <!ENTITY and <!DOCTYPE declarations before the document reaches the underlying XML parser. The regex patterns assume the input is encoded in a known single-byte or UTF-8 representation.
Attackers can supply XML content encoded in UCS-4 variants. The W3C XML specification permits parsers to auto-detect this encoding from the byte order mark or initial bytes. Because the scanner's regexes do not match against multi-byte UCS-4 sequences, the malicious entity declarations slip past sanitization. The downstream XML parser then decodes the document and resolves the external entities. See the PhpSpreadsheet Security Advisory GHSA-jw4x-v69f-hh5w for the full description.
Root Cause
The root cause is incomplete input normalization before pattern matching. The findCharSet method does not detect UCS-4 (and its little-endian, big-endian, and unusual byte-order variants). The scan method then evaluates regex patterns against bytes the parser will later interpret in a different encoding, producing a parser-scanner differential [CWE-611].
Attack Vector
An attacker delivers a crafted spreadsheet file, such as an XLSX or XML-based format, containing an XXE payload encoded in UCS-4. Any application that calls a PhpSpreadsheet reader on attacker-controlled input is exposed. Exploitation requires no authentication or user interaction beyond uploading or supplying the malicious file. The external entity can reference local files via file:// URIs or trigger outbound HTTP requests for blind exfiltration.
No verified public proof-of-concept code is available. Refer to the OWASP XXE guidance and the W3C encoding detection rules for the underlying behavior abused by this bypass.
Detection Methods for CVE-2024-47873
Indicators of Compromise
- Spreadsheet uploads whose initial bytes match UCS-4 byte order marks (00 00 FE FF, FF FE 00 00, 00 00 00 3C, 3C 00 00 00).
- Unexpected outbound network connections from PHP worker processes immediately after a file import.
- PHP error or warning logs referencing entity resolution failures from libxml.
- Read access to sensitive files such as /etc/passwd or application configuration files by the web server user following a spreadsheet upload.
Detection Strategies
- Inspect uploaded spreadsheet files for embedded <!DOCTYPE or <!ENTITY declarations after decoding all common XML encodings, including UCS-4 variants.
- Audit dependency manifests (composer.lock) for phpoffice/phpspreadsheet versions below the fixed releases.
- Enable libxml_set_external_entity_loader logging in PHP to record any external entity resolution attempts.
Monitoring Recommendations
- Alert on PHP-FPM or Apache worker processes initiating outbound DNS or HTTP requests to non-allowlisted destinations.
- Monitor file system reads of sensitive paths (/etc, /proc, application secrets) attributed to the web server user.
- Track spreadsheet ingestion endpoints for anomalous response sizes or response timing that may indicate file disclosure.
How to Mitigate CVE-2024-47873
Immediate Actions Required
- Upgrade phpoffice/phpspreadsheet to 1.29.4, 2.1.3, 2.3.2, or 3.4.0 depending on your branch.
- Inventory all applications, internal tools, and batch jobs that consume user-supplied spreadsheets.
- Reject uploads that do not match expected encodings at the application gateway until patches are deployed.
Patch Information
The maintainers released fixed builds in versions 1.29.4, 2.1.3, 2.3.2, and 3.4.0. The patch hardens findCharSet to recognize UCS-4 encodings and normalizes input before applying regex-based scanning. Update via Composer using composer require phpoffice/phpspreadsheet:^3.4.0 or the appropriate constraint for your branch. Review the GitHub Security Advisory GHSA-jw4x-v69f-hh5w for full release notes.
Workarounds
- Disable external entity loading globally with libxml_set_external_entity_loader(static fn() => null); before invoking any PhpSpreadsheet reader.
- Validate uploaded files against a strict allowlist of formats and reject anything containing UCS-4 byte order marks.
- Run spreadsheet processing in a network-restricted container that cannot reach internal services or the public internet.
# Configuration example
composer update phpoffice/phpspreadsheet --with-dependencies
composer show phpoffice/phpspreadsheet | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
