CVE-2024-45293

Estado: AnalizadaAlta (7.5)—

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function.

Leer descripción completaMostrar menos

The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.78%
Percentil entre todas las CVEs puntuadas: 86
Fecha de la puntuación: 3/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1005 Data from Local Systemcollection90 %

Explotación remota (AV:N, PR:N, UI:N) de aplicación web expuesta que permite subida de archivos maliciosos XLSX. XXE bypass obtiene lectura de archivos del servidor (C:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

Phpoffice — Phpspreadsheet

CWE

CWE-611
CWE-611

Referencias

https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-45293",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45293",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-07T20:23:44.790245Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.2.0, < 2.3.0"
            },
            {
              "status": "affected",
              "version": "< 1.29.1"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.1.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*"
          ],
          "vendor": "phpoffice",
          "product": "phpspreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0",
              "lessThan": "2.3.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.29.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.1.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-07T20:15:06.100",
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding=\"*\"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "PHPSpreadsheet es una librería PHP pura para leer y escribir archivos de hojas de cálculo. El escáner de seguridad responsable de prevenir ataques XXE en el lector XLSX se puede eludir modificando ligeramente la estructura XML, utilizando espacios en blanco. En servidores que permiten a los usuarios cargar sus propias hojas de Excel (XLSX), los archivos del servidor y la información confidencial se pueden divulgar proporcionando una hoja manipulada. La función de escaneo de seguridad en src/PhpSpreadsheet/Reader/Security/XmlScanner.php contiene una comprobación de codificación XML defectuosa para recuperar la codificación XML del archivo de entrada en la función toUtf8. La función busca la codificación XML a través de una expresión regular definida que busca `encoding=\"*\"` y/o `encoding='*'`, si no se encuentra, se utiliza de forma predeterminada la codificación UTF-8 que elude la lógica de conversión. Esta lógica se puede utilizar para pasar un payload XXE codificada en UTF-7, utilizando un espacio en blanco antes o después del = en la definición del atributo. Divulgación de información confidencial a través de XXE en sitios que permiten a los usuarios cargar sus propias hojas de cálculo de Excel y analizarlas mediante el analizador de Excel de PHPSpreadsheet. Este problema se ha solucionado en las versiones de lanzamiento 1.29.1, 2.1.1 y 2.3.0. Se recomienda a todos los usuarios que actualicen la versión. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:53:58.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "520A70B7-2C60-4064-B452-538ED7A8D30E",
              "versionEndExcluding": "1.29.1"
            },
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79F5B018-FDB7-40DC-9B67-7312ED70808F",
              "versionEndExcluding": "2.1.1",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B62CAAE-2E1E-42A2-9152-2DB7E3DA36A8",
              "versionEndExcluding": "2.3.0",
              "versionStartIncluding": "2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}