CVE-2024-45291
📋 TL;DR
PHPSpreadsheet has a vulnerability where attackers can create malicious XLSX files that cause arbitrary file reads and Server-Side Request Forgery when image embedding is enabled. This affects all PHPSpreadsheet users with setEmbedImages(true) enabled. In worst cases with expect:// wrapper enabled, remote code execution is possible.
💻 Affected Systems
- PHPSpreadsheet
📦 What is this software?
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via expect:// wrapper leading to full system compromise, arbitrary file disclosure, and SSRF attacks against internal services.
Likely Case
Arbitrary file reads exposing sensitive configuration files, credentials, and SSRF attacks against internal network services.
If Mitigated
Limited impact if image embedding is disabled or proper file upload restrictions are in place.
🎯 Exploit Status
Exploitation requires file upload capability and setEmbedImages(true) enabled. No authentication bypass needed beyond file upload access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.29.2, 2.1.1, or 2.3.0
Vendor Advisory: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4
Restart Required: No
Instructions:
1. Update PHPSpreadsheet via Composer: composer require phpoffice/phpspreadsheet:^1.29.2 (or ^2.1.1 or ^2.3.0). 2. Verify update with composer show phpoffice/phpspreadsheet. 3. Test spreadsheet processing functionality.
🔧 Temporary Workarounds
Disable image embedding
allSet setEmbedImages(false) or remove the call entirely from HTML writer configuration.
$writer->setEmbedImages(false);
🧯 If You Can't Patch
- Disable image embedding in all HTML writer configurations
- Implement strict file upload validation rejecting XLSX files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check if setEmbedImages(true) is used in code and PHPSpreadsheet version is below 1.29.2, 2.1.1, or 2.3.0.Check Version:
composer show phpoffice/phpspreadsheet | grep versionsVerify Fix Applied:
Verify PHPSpreadsheet version is 1.29.2+, 2.1.1+, or 2.3.0+ and test with sample XLSX files containing external image references.📡 Detection & Monitoring
Log Indicators:
- Unusual file read operations from PHPSpreadsheet process
- Outbound HTTP requests to internal IPs from spreadsheet processing
Network Indicators:
- HTTP requests to internal services triggered by file processing
- Data exfiltration via data: URLs in output
SIEM Query:
source="php" AND (process="phpspreadsheet" OR message="setEmbedImages") AND (event="file_read" OR event="http_request")