CVE-2024-45048
Published: 28 August 2024
Summary
CVE-2024-45048 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Phpoffice Phpspreadsheet. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2584
Vulnerability details
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if…
more
error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The XXE vulnerability (CWE-611) in PHPSpreadsheet allows bypassing the encoding filter to process malicious XML in XLSX files (e.g., sharedStrings.xml), enabling attackers to read arbitrary local files via external entities and php:// wrappers (LFI), even with muted error reporting.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.