PhpSpreadsheet vulnerable a SSRF al leer y mostrar un documento HTML procesado en el navegador

The SSRF vulnerability in PhpSpreadsheet arises from improper handling of user-supplied input within the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, specifically the setPath method. An attacker can craft malicious input that, when processed by the application, results in a request being sent to an attacker-controlled server or an internal resource. This could allow an attacker to read sensitive files, interact with internal APIs, or even perform actions on behalf of the application. The potential impact includes unauthorized access to internal systems, data exfiltration, and potentially, denial of service if the attacker can trigger resource-intensive requests.

Applications utilizing PhpSpreadsheet versions prior to 1.30.0 are at risk, particularly those that allow user-supplied data to influence the setPath parameter without proper sanitization. Shared hosting environments where multiple applications share the same PhpSpreadsheet installation are also at increased risk, as a vulnerability in one application could potentially be exploited to compromise others.

• php: Examine application logs for unusual outbound requests originating from the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class. Use grep to search for patterns related to URL manipulation or requests to unexpected domains.

grep 'PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing' /path/to/application/logs/access.log | grep -i 'http:'

• php: Monitor PHP error logs for warnings or errors related to URL parsing or network connections.

journalctl -u php-fpm -f | grep -i 'URL parsing error'

• generic web: Use curl to probe for potential SSRF endpoints. Attempt to access internal resources or external domains through the vulnerable setPath parameter.

curl 'http://localhost/path/to/phpspreadsheet?path=http://internal.example.com/sensitive_data' -s

1. 2025-08-25Disclosure

   disclosure

1. Reservado2025-07-21
2. Publicada2025-08-25
3. Modificada2025-08-29
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-54370 is to upgrade to PhpSpreadsheet version 1.30.0 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict input validation on the setPath method to prevent the inclusion of malicious URLs. Additionally, configure a Web Application Firewall (WAF) to block requests to known malicious domains or patterns. Carefully review and restrict network access for the PhpSpreadsheet application to minimize the potential blast radius of a successful SSRF attack. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked or handled safely.

Última actualización

5.7.0recientemente