CVE-2024-45291 Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
Attackers can read arbitrary files and execute code via SSRF in PHPSpreadsheet when image embedding is enabled in the HTML writer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45291?
CVE-2024-45291 is a medium-severity path traversal vulnerability in PHPOffice PhpSpreadsheet, published on 7 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. there are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-45291?
8 open source packages ship an affected version, including phpoffice/phpspreadsheet and phpoffice/phpexcel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.29.2 |
phpoffice/phpspreadsheet Packagist | All versions | 1.29.2 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.1 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.1 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.3.0 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.3.0 |
2 more packages
phpoffice/phpexcel Packagist | All versions to 1.8.2 | None |
phpoffice/phpexcel Packagist | All versions to 1.8.2 | None |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2024-45291?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.29.2, 2.1.1 or 2.3.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-45291 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45291 exists.
Other vulnerabilities in PHPOffice PhpSpreadsheet
- CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Sources
Also known as GHSA-w9xv-qf98-ccq4.