CVE-2024-45290 Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
Attackers can exploit crafted XLSX files to perform SSRF and path traversal, leaking sensitive server files or internal URLs via php://filter wrappers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45290?
CVE-2024-45290 is a high-severity server-side request forgery vulnerability in PHPOffice PhpSpreadsheet, published on 7 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-45290?
8 open source packages ship an affected version, including phpoffice/phpspreadsheet and phpoffice/phpexcel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.29.2 |
phpoffice/phpspreadsheet Packagist | All versions | 1.29.2 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.1 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.1 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.3.0 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.3.0 |
2 more packages
phpoffice/phpexcel Packagist | All versions to 1.8.2 | None |
phpoffice/phpexcel Packagist | All versions to 1.8.2 | None |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2024-45290?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.29.2, 2.1.1 or 2.3.0.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-45290 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45290 exists.
Other vulnerabilities in PHPOffice PhpSpreadsheet
- CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Sources
Also known as GHSA-5gpr-w2p5-6m37.