Improper Restriction of XML External Entity Reference

Summary

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The "XmlScanner" class has a "scan" method which should prevent XXE attacks. However, in a bypass of the previously reported "CVE-2024-47873", the regexes from the "findCharSet" method, which is used for determining the current encoding can be bypassed by using a payload in the encoding "UTF-7", and adding at end of the file a comment with the value "encoding=`UTF-8`" with `"`, which is matched by the first regex, so that "encoding=`UTF-7`" with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. This issue affects phpoffice/phpspreadsheet versions through 1.29.2, 2.0.0 through 2.1.1, 2.2.0 through 2.3.0, and 3.3.0. Note: This has the same fix as CVE-2024-47873.