CVE-2024-47873: XmlScanner bypass leads to XXE
(updated )
The XmlScanner class has a scan method which should prevent XXE attacks.
However, the regexes used in the scan method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing as described in https://www.w3.org/TR/xml/#sec-guessing-no-ext-info.
References
- github.com/PHPOffice/PhpSpreadsheet
- github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php
- github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w
- github.com/advisories/GHSA-jw4x-v69f-hh5w
- nvd.nist.gov/vuln/detail/CVE-2024-47873
- owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- www.w3.org/TR/xml/
Code Behaviors & Features
Detect and mitigate CVE-2024-47873 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →