GitHub Security Advisory: GHSA-rx7m-68vc-ppxh
Package: phpoffice/phpspreadsheet (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 4.0.0, < 5.0.0
Patched in: 5.0.0

Summary: PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

Details:
**Product:** PhpSpreadsheet
**Version:** 3.8.0
**CWE-ID:** CWE-918: Server-Side Request Forgery (SSRF)
**CVSS vector v.3.1:** 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
**CVSS vector v.4.0:** 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
**Description:** SSRF occurs when a processed HTML document is read and displayed in the browser
**Impact:** Server-Side Request Forgery
**Vulnerable component:** the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class, `setPath` method
**Exploitation conditions:** getting a string from the user that is passed to the HTML reader
**Mitigation:** improved processing of the `$path` variable of the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class is needed
**Researcher: Aleksey Solovev (Positive Technologies)**

# Research
The researcher discovered zero-day vulnerability Server-Side Request Forgery (SSRF) (in the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class) in Phpspreadsheet.
The latest version (3.8.0) of the `phpoffice/phpspreadsheet` library was installed. Below are the details of the installation:

*Listing 1. Installing the phpoffice/phpspreadsheet library*
```
$ composer require phpoffice/phpspreadsheet --prefer-source
```
The code that processes the HTML string with further rendering and displaying the result in the browser.
*Listing 2. Executable file index.php using the PhpSpreadsheet library*
```
<?php

require __DIR__ . '/vendor/autoload.php';

$inputFileType = 'Html';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader($inputFileType);  


$inputFileName = './doc/file.html';
$spreadsheet = $reader->load($inputFileName); 

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); 
print($writer->generateHTMLAll());
```

Also, the `./doc/file.html` has the following content: the `img` tag with the `src` attribute, which contains the value `http:// 127.0.0.1:1337`

*Listing 3. The ./doc/file.html file*
```
<table>
    <tr>
        <img src="http://127.0.0.1:1337">
    </tr>
</table>
```
The vulnerability lies in the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class.
 
Figure 1. The `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class, `setPath` method.

![fig1](https://github.com/user-attachments/assets/75433f59-fac6-46d5-bcfd-6d0174bfcedd)

Figure 2 below demonstrates the SSRF vulnerability exploitation.

![fig2](https://github.com/user-attachments/assets/3601692b-b077-420f-a2fb-8af0b66b6475)

Figure 2. Demonstration of the SSRF vulnerability exploitation

Also, there is code on line 154 that could potentially be used by an attacker to perform unsafe deserialization via the `phar` archive and the `file_exists` method.
 
Figure 3. Opportunity to perform phar deserialization
![fig3](https://github.com/user-attachments/assets/3d7d4fc2-1b89-4925-82fa-e21c773efd47)

_____________________________________________

Please, assign all credits to: Aleksey Solovev (Positive Technologies)

# Credit

Aleksey Solo