CVE-2024-45290

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37	Exploit Patch Third Party Advisory
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4	Not Applicable

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::

History

No history.

Information

Published : 2024-10-07 21:15

Updated : 2024-10-16 19:54

NVD link : CVE-2024-45290

Mitre link : CVE-2024-45290

CVE.ORG link : CVE-2024-45290

JSON object : View

Products Affected

phpoffice

phpspreadsheet

CWE

CWE-36

Absolute Path Traversal

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-45290", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-10-07T21:15:17.397", "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-36"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "PHPSpreadsheet es una librer\u00eda PHP pura para leer y escribir archivos de hojas de c\u00e1lculo. Un atacante puede crear un archivo XLSX que vincule archivos multimedia desde URL externas. Al abrir el archivo XLSX, PhpSpreadsheet recupera el tama\u00f1o y el tipo de imagen leyendo el contenido del archivo, si la ruta proporcionada es una URL. Al usar URL `php://filter` especialmente manipulada, un atacante puede filtrar el contenido de cualquier archivo o URL. Tenga en cuenta que esta vulnerabilidad es diferente de GHSA-w9xv-qf98-ccq4 y reside en un componente diferente. Un atacante puede acceder a cualquier archivo del servidor o filtrar informaci\u00f3n de URL arbitrarias, lo que podr\u00eda exponer informaci\u00f3n confidencial, como las credenciales de AWS IAM. Este problema se ha solucionado en las versiones de lanzamiento 1.29.2, 2.1.1 y 2.3.0. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-10-16T19:54:53.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FB20F02-0DCA-4875-B1AF-E6969820AD9A", "versionEndExcluding": "1.29.2"}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79F5B018-FDB7-40DC-9B67-7312ED70808F", "versionEndExcluding": "2.1.1", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B62CAAE-2E1E-42A2-9152-2DB7E3DA36A8", "versionEndExcluding": "2.3.0", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}