Lab 241 — LedgerFlow — XXE via Encoding Bypass in Excel Import

hackadvisor

Task: PHP web app with XLSX import using PhpSpreadsheet; XmlScanner blocks standard XXE via DOCTYPE/ENTITY regex. Solution: Encode malicious XML (sharedStrings.xml) as UTF-32BE — three null bytes between characters defeat the \\0? regex pattern, while libxml2 auto-detects the encoding and resolves the XXE entity to read /root/flag.txt.