CVE-2024-48917: PhpSpreadsheet XXE Vulnerability

CVE-2024-48917 Overview

CVE-2024-48917 is an XML External Entity (XXE) vulnerability in PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files. The flaw exists in the XmlScanner class, whose scan method is intended to block XXE payloads. Attackers can bypass the sanitizer by crafting a file using UTF-7 encoding and appending a trailing comment containing encoding="UTF-8" with double quotes. This tricks the findCharSet regex logic into selecting the wrong encoding, allowing the malicious encoding='UTF-7' header with single quotes to pass through unmatched. The issue is a bypass of the previously reported CVE-2024-47873 and is tracked under [CWE-611].

Critical Impact
A network-reachable attacker can submit a crafted spreadsheet to trigger XML External Entity processing, leading to disclosure of sensitive local files and server-side request forgery against internal infrastructure.

Affected Products

PhpSpreadsheet versions prior to 1.9.4 (1.x branch)
PhpSpreadsheet versions prior to 2.1.3 and 2.3.2 (2.x branch)
PhpSpreadsheet versions prior to 3.4.0 (3.x branch)

Discovery Timeline

2024-11-18 - CVE-2024-48917 published to NVD
2025-03-07 - Last updated in NVD database

Technical Details for CVE-2024-48917

Vulnerability Analysis

The XmlScanner class in PhpSpreadsheet is responsible for detecting and rejecting XML payloads that would otherwise trigger external entity expansion in downstream PHP XML parsers. Its scan method calls findCharSet to determine the character set of the document before applying sanitization patterns. The character-set detection relies on regular expressions to locate the encoding= attribute inside the XML declaration.

The original CVE-2024-47873 fix added a second regex intended to catch UTF-7 declarations missed by the first. However, the regexes apply different quoting and ordering assumptions. By placing encoding='UTF-7' with single quotes in the XML header and appending a trailing comment containing encoding="UTF-8" with double quotes, an attacker satisfies the first regex with the benign UTF-8 match while preventing the second regex from flagging UTF-7. The scanner then operates on the file as if it were UTF-8, leaving the UTF-7 encoded external entity definition intact for the XML parser to resolve.

Root Cause

The root cause is inconsistent and incomplete regular-expression-based encoding detection in findCharSet. Sanitization decisions depend on a fragile pattern match rather than a normalized parse of the XML prolog, so an attacker who can introduce a second encoding= token elsewhere in the file controls which regex wins.

Attack Vector

Exploitation requires only that the target application accept and parse an attacker-supplied spreadsheet file through PhpSpreadsheet. No authentication or user interaction beyond normal file upload workflows is needed. Successful exploitation enables reading of arbitrary files readable by the PHP process and outbound SSRF requests through XML entity resolution.

No verified proof-of-concept code is publicly attributed to this CVE. The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-7cc9-j4mv-vcjp and the XmlScanner source. For background on the underlying class of attack, see the OWASP XXE Vulnerability Overview.

Detection Methods for CVE-2024-48917

Indicators of Compromise

Spreadsheet uploads (.xlsx, .xml, .xlsm) containing an XML prolog with encoding='UTF-7' in single quotes alongside a trailing comment with encoding="UTF-8".
Outbound HTTP, FTP, or DNS requests originating from the PHP application server to attacker-controlled hosts shortly after a spreadsheet import.
Unexpected access by the web server process to local files such as /etc/passwd, application configuration files, or credential stores.

Detection Strategies

Inspect uploaded XML and Office Open XML payloads for UTF-7 encoded sequences (+ADw-, +AC0-) and for multiple encoding= declarations within the same document.
Audit dependency manifests (composer.lock) for phpoffice/phpspreadsheet versions below 1.9.4, 2.1.3, 2.3.2, or 3.4.0.
Enable PHP error logging for libxml external entity loading attempts and alert on entries referencing file://, http://, or php:// schemes from spreadsheet import code paths.

Monitoring Recommendations

Log and review all file uploads processed by PhpSpreadsheet, capturing source IP, user identity, file hash, and parser output.
Monitor egress traffic from application servers and alert on connections to external destinations that do not match expected backend integrations.
Track invocations of XmlScanner::scan and downstream simplexml_load_* or DOMDocument::load* calls for anomalous frequency or error patterns.

How to Mitigate CVE-2024-48917

Immediate Actions Required

Upgrade phpoffice/phpspreadsheet to version 1.9.4, 2.1.3, 2.3.2, or 3.4.0 or later, depending on the branch in use.
Inventory all applications and microservices that import spreadsheets through PhpSpreadsheet and prioritize internet-facing upload endpoints for patching.
Restrict the filesystem and network privileges of the PHP runtime so that successful XXE has limited blast radius.

Patch Information

The maintainers fixed the encoding detection bypass in PhpSpreadsheet versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0. Update via Composer with composer require phpoffice/phpspreadsheet:^3.4.0 (or the appropriate branch constraint) and redeploy. Refer to the GitHub Security Advisory GHSA-7cc9-j4mv-vcjp for branch-specific release notes.

Workarounds

Disable external entity loading globally in PHP by ensuring libxml_disable_entity_loader(true) or equivalent LIBXML_NOENT-free parser configuration is enforced before any XML parsing.
Reject uploaded spreadsheets that declare UTF-7 encoding or contain multiple encoding= tokens at the upload boundary.
Run spreadsheet parsing in an isolated, network-restricted worker with no access to sensitive local files or internal services.

bash

# Configuration example: upgrade PhpSpreadsheet via Composer
composer require phpoffice/phpspreadsheet:^3.4.0
composer update phpoffice/phpspreadsheet

# Verify installed version
composer show phpoffice/phpspreadsheet | grep versions