« Volver al listado

CVE-2024-45290

Estado: AnalizadaAlta (7.5)—

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component.

Leer descripción completaMostrar menos

An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto sin privilegios ni interacción en librería PHP expuesta. PHPSpreadsheet procesa URLs malformadas (php://filter) para filtrar archivos/credenciales del servidor, permitiendo lectura de datos sensibles y potencial exfiltración.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

Phpoffice — Phpspreadsheet

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45290",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45290",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-08T18:29:57.129855Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.29.2"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.1.1"
            },
            {
              "status": "affected",
              "version": ">= 2.2.0, < 2.3.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*"
          ],
          "vendor": "phpoffice",
          "product": "phpspreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.29.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.1.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.2.0",
              "lessThan": "2.3.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-07T21:15:17.397",
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4",
      "tags": [
        "Not Applicable"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-36"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "PHPSpreadsheet es una librería PHP pura para leer y escribir archivos de hojas de cálculo. Un atacante puede crear un archivo XLSX que vincule archivos multimedia desde URL externas. Al abrir el archivo XLSX, PhpSpreadsheet recupera el tamaño y el tipo de imagen leyendo el contenido del archivo, si la ruta proporcionada es una URL. Al usar URL `php://filter` especialmente manipulada, un atacante puede filtrar el contenido de cualquier archivo o URL. Tenga en cuenta que esta vulnerabilidad es diferente de GHSA-w9xv-qf98-ccq4 y reside en un componente diferente. Un atacante puede acceder a cualquier archivo del servidor o filtrar información de URL arbitrarias, lo que podría exponer información confidencial, como las credenciales de AWS IAM. Este problema se ha solucionado en las versiones de lanzamiento 1.29.2, 2.1.1 y 2.3.0. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:53:57.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FB20F02-0DCA-4875-B1AF-E6969820AD9A",
              "versionEndExcluding": "1.29.2"
            },
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79F5B018-FDB7-40DC-9B67-7312ED70808F",
              "versionEndExcluding": "2.1.1",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B62CAAE-2E1E-42A2-9152-2DB7E3DA36A8",
              "versionEndExcluding": "2.3.0",
              "versionStartIncluding": "2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}