CVE-2019-12331

Vulnerability

Overview

CVE-2019-12331 affects PHPOffice PhpSpreadsheet versions before 1.8.0, where the XmlScanner decodes sheet1.xml from .xlsx files to UTF-8 if a different encoding is declared in the header. This behavior was intended to mitigate CVE-2018-19277, but the fix proved insufficient [2]. By double-encoding the XML payload to UTF-7, an attacker can bypass the check for the string <!ENTITY and perform an XML External Entity (XXE) processing attack [1][2].

Exploitation

Details

The root cause lies in the XmlScanner's handling of encoding declarations. The scanner attempted to convert non-UTF-8 XML to UTF-8, but it did not account for attacks using multiple encoding layers, such as UTF-7. An attacker can craft a malicious .xlsx file with a sheet1.xml that declares UTF-7 encoding and includes a double-encoded entity reference. This bypasses the pattern check for <!ENTITY because the string is not present in the decoded UTF-8 form [2]. The vulnerability can be triggered without authentication if the application processes user-uploaded spreadsheet files.

Impact

Successful exploitation allows an XXE attack, potentially leading to disclosure of local files, server-side request forgery (SSRF), denial of service, or other impacts depending on the application's context. Since PhpSpreadsheet is a PHP library used for reading and writing spreadsheet files, any web application that accepts .xlsx uploads and processes them with an affected version is at risk [4].

Mitigation

The vulnerability is fixed in PhpSpreadsheet version 1.8.0. The patch (commit 0e6238c) improves the XmlScanner to properly disable entity loader and handle encoding conversions more securely [1][3]. Users should upgrade to version 1.8.0 or later. There is no mention of a workaround for older versions, and the vendor recommends upgrading as the primary mitigation [3][4].