PhpSpreadsheet's webService() method validates URLs against a domain whitelist before fetching content. However, because PHP's HTTP stream wrapper automatically follows HTTP 301/302 redirects without re-validating the redirect target, an attacker can bypass the whitelist by triggering redirects from whitelisted domains to arbitrary internal or external URLs. This SSRF vulnerability allows an attacker who can upload XLSX files and invoke getCalculatedValue() to read up to 32,767 bytes from arbitrary URLs, including cloud metadata endpoints (e.g., http://169.254.169.254/), internal services, and ports. The vulnerability affects multiple version ranges up to 5.8.0 and has been fixed in subsequent patch releases.

An attacker able to upload malicious XLSX files can exploit this SSRF vulnerability to read sensitive internal resources and cloud metadata service endpoints, potentially exposing cloud credentials and enabling internal network reconnaissance. The vulnerability does not impact integrity or availability but has a high confidentiality impact. This can lead to unauthorized access to sensitive information and further compromise of internal systems.

A fix is available in PhpSpreadsheet versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that their environment is updated accordingly. Until patched, avoid processing untrusted XLSX files that use the WEBSERVICE() function with domain whitelisting.