PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, is affected when external image loading is enabled. An attacker who controls an allowed image host can use an HTTP redirect to make the server send a request to an internal address, potentially reaching internal services or cloud metadata endpoints.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- PHPOffice PhpSpreadsheet
fixed in 1.30.7; From 2.0.0 · fixed in 2.1.19; From 2.2.0 · fixed in 2.4.8; From 3.3.0 · fixed in 3.10.8; From 4.0.0 · fixed in 5.10.0
- phpoffice/phpspreadsheetPackagist
From 4.0.0 · fixed in 5.10.0
- phpoffice/phpspreadsheetPackagist
From 3.3.0 · fixed in 3.10.8
- phpoffice/phpspreadsheetPackagist
From 2.2.0 · fixed in 2.4.8
- phpoffice/phpspreadsheetPackagist
From 2.0.0 · fixed in 2.1.19
- phpoffice/phpspreadsheetPackagist
fixed in 1.30.7