PHPOffice PhpSpreadsheet up to 1.7.x XML Data std_table.php xml external entity reference

Summaryinfo

A vulnerability classified as critical was found in PHPOffice PhpSpreadsheet up to 1.7.x. This affects an unknown function of the file nagvis-master/share/userfiles/gadgets/std_table.php of the component XML Data Handler. Such manipulation with the input ?<!ENTITY? leads to xml external entity reference. This vulnerability is listed as CVE-2019-12331. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in PHPOffice PhpSpreadsheet up to 1.7.x. Affected by this issue is an unknown function of the file nagvis-master/share/userfiles/gadgets/std_table.php of the component XML Data Handler. The manipulation with the input value ?<!ENTITY? leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, integrity, and availability. CVE summarizes:

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.

The weakness was presented 11/07/2019 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2019-12331 since 05/27/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:nagvis-master/share/userfiles/gadgets/std_table.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• PHPOffice

Name

• PhpSpreadsheet

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7

Website

• Product: https://github.com/PHPOffice/PhpSpreadsheet/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion