PhpSpreadsheet 存在 SSRF 漏洞，当在浏览器中读取和显示处理后的 HTML 文档时

攻击者可以利用此 SSRF 漏洞，通过 PhpOffice\PhpSpreadsheet\Worksheet\Drawing 类中的 setPath 方法，构造包含恶意 URL 的 HTML 文档路径。服务器在读取和显示该文档时，会向攻击者指定的 URL 发送请求。这可能导致攻击者访问内部资源、读取敏感文件、执行内部端口扫描，甚至可能在某些情况下执行代码。由于攻击者无需身份验证即可发起攻击，因此该漏洞的潜在影响非常大，可能导致数据泄露和系统被入侵。

Applications utilizing PhpSpreadsheet versions prior to 1.30.0 are at risk, particularly those that allow user-supplied data to influence the setPath parameter without proper sanitization. Shared hosting environments where multiple applications share the same PhpSpreadsheet installation are also at increased risk, as a vulnerability in one application could potentially be exploited to compromise others.

• php: Examine application logs for unusual outbound requests originating from the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class. Use grep to search for patterns related to URL manipulation or requests to unexpected domains.

grep 'PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing' /path/to/application/logs/access.log | grep -i 'http:'

• php: Monitor PHP error logs for warnings or errors related to URL parsing or network connections.

journalctl -u php-fpm -f | grep -i 'URL parsing error'

• generic web: Use curl to probe for potential SSRF endpoints. Attempt to access internal resources or external domains through the vulnerable setPath parameter.

curl 'http://localhost/path/to/phpspreadsheet?path=http://internal.example.com/sensitive_data' -s

1. 2025-08-25Disclosure

   disclosure

1. 已保留2025-07-21
2. 发布日期2025-08-25
3. 修改日期2025-08-29
4. EPSS 更新日期2026-03-23

最有效的缓解措施是升级到 phpoffice/phpspreadsheet 1.30.0 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：首先，严格验证用户提供的 HTML 文档路径，确保其指向可信的资源。其次，实施网络隔离策略，限制服务器对外部网络的访问。第三，使用 Web 应用防火墙 (WAF) 或代理服务器来过滤恶意请求，阻止 SSRF 攻击。最后，监控服务器日志，检测异常的网络请求，及时发现和响应潜在的攻击。