Critical Vulnerability in Popular PHP Library: Threat to Millions of Websites

Critical Vulnerability in Popular PHP Library: Threat to Millions of Websites

A significant event in the world of web development is forcing an urgent review of security policies. Cybersecurity researchers have discovered a critical vulnerability (CVE-2024-XXXX) in one of the most widely used libraries for PHP — PhpSpreadsheet. This package, used for working with spreadsheets (Excel, LibreOffice Calc), is part of thousands of CMS, CRM systems, and frameworks, including Laravel, Symfony, and WordPress plugins.

What is the essence of the problem?

The vulnerability has been rated 9.8 out of 10 on the CVSS scale — the maximum danger level. It allows an attacker to execute arbitrary code on the server (Remote Code Execution) without authentication. To carry out an attack, it is enough to send a specially crafted .xlsx or .ods file to the server, which is then processed by the library. As a result, a hacker can:

• Gain full control over the server's file system
• Steal databases (including user passwords)
• Install backdoors for persistent access
• Use the server for DDoS attacks or spam distribution

Which versions are affected?

The issue affects all versions of the PhpSpreadsheet library up to 3.4.0. The vulnerability is related to improper handling of XML markup within Office Open XML (OOXML) files. When parsing cells with formulas, the library does not filter incoming data, allowing malicious PHP code to be injected.

According to Packagist, the PhpSpreadsheet library has been installed over 150 million times. The following are at risk:

• All projects using versions 1.x, 2.x, and 3.x up to 3.4.0
• Sites where users can upload Excel files (product imports, report uploads)
• Servers where formula processing in spreadsheets is enabled

How to protect yourself?

The PhpSpreadsheet developers have already released a patch in version 3.4.1. If you use Composer, run the command:

composer update phpoffice/phpspreadsheet

Additional security measures:

• Temporarily disable formula processing in the library configuration
• Install a WAF (Web Application Firewall) to block suspicious requests
• Limit the size of uploaded files and check MIME types

Conclusions

This vulnerability reminds us of the critical importance of timely dependency updates. Even if your site does not work directly with Excel, the library may be included through third-party modules. Check your composer.lock right now — perhaps today your server is in the danger zone.

Follow updates on PythonLib — we promptly publish security news in the world of PHP, Python, and other technologies.