GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
SummaryThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.DetailsIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.The stream context does not disable redirect following:PHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirect the request to any arbitrary URL, including internal network addresses.**Vulnerable code** (`Calculation/Web/Service.php`):Additionally, the whitelist check uses only the hostname from `parse_url()`, ignoring the port. This means whitelisting `example.com` permits access to all ports on that host.PoC**Prerequisites:**Application uses PhpSpreadsheet >= 5.4.0Application calls `$spreadsheet->setDomainWhiteList([...])` with at least one domainApplication calls `$cell->getCalculatedValue()` on uploaded XLSX files**Attack steps:**Identify or control a URL on a whitelisted domain that returns an HTTP 302 redirect (e.g., an open redirect endpoint, or a domain the attacker controls).Craft an XLSX file with a WEBSERVICE formula targeting the redirect URL:Upload the XLSX to the target application. The calculation engine:Validates `whitelisted-domain.com` against the whitelist — **passes**Calls `file_get_contents("http://whitelisted-domain.com/redirect?url=...")``file_get_contents` follows the 302 redirect to `http://169.254.169.254/latest/meta-data/` — **no re-validation**Returns the cloud metadata response as the cell's calculated value**Lab reproduction:**Confirmed on PhpSpreadsheet 5.7.0 with PHP 8.3. Confirmed via Burp Collaborator (OOB HTTP interaction received at attacker-controlled domain through the redirect chain).ImpactAn attacker who can upload XLSX files to an application that uses `setDomainWhiteList()` and `getCalculatedValue()` can:**Bypass the domain whitelist** by routing requests through a whitelisted domain that redirects to internal targets**Exfiltrate cloud metadata** (AWS/GCP/Azure instance credentials) via `http://169.254.169.254/`**Access internal services** not exposed to the internet**Port-scan internal networks** via any whitelisted hostname (port is not validated)This is a full-read SSRF — the complete HTTP response body (up to 32,767 bytes) is returned to the attacker as the cell's calculated value.**Attack scenarios:**Whitelisted domain has an open redirect vulnerabilityAttacker controls the whitelisted domain (e.g., a free-tier API service)DNS rebinding after the whitelist checkSuggested FixDisable redirect following in the stream context:Alternatively, if redirects must be supported, implement manual redirect following that re-validates each hop's hostname against the domain whitelist.Additionally, consider including the port in the whitelist check to prevent port scanning of whitelisted hosts.RelatedThis vulnerability is in the same function as the original WEBSERVICE() SSRF (unrestricted in versions < 5.4.0, no CVE assigned), but is a distinct issue: it bypasses the specific mitigation (domain whitelist) that was introduced in PR #4751 to address the original SSRF.Existing SSRF CVEs in PhpSpreadsheet (CVE-2024-45290, CVE-2024-45291, CVE-2025-54370) are all in the Drawing/image loading code path, not in the WEBSERVICE calculation engine.
CVSS v3.1 score: 7.7