CVE-2024-56412: PhpSpreadsheet XSS Sanitizer Bypass via JavaScript Protocol
Summary
CVE-2024-56412: PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.7
>= 2.0.0, < 2.1.6
>= 2.2.0, < 2.3.5
>= 3.0.0, < 3.7.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats, including Excel. It allows developers to create, modify, and read spreadsheet documents programmatically. The library is widely utilized in PHP applications for generating reports and handling data in a tabular format. However, it has been found vulnerable to a cross-site scripting (XSS) issue, which can be exploited through specially crafted Excel files.
Vulnerability Detail
The vulnerability arises from PhpSpreadsheet's improper handling of input during the generation of HTML from Excel files. An attacker can craft an Excel file containing hyperlinks that utilize the JavaScript protocol with special characters. When a user opens this file, the library processes the hyperlink and generates an HTML link that executes arbitrary JavaScript code in the user's browser. This can lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.71.29.7composer require phpoffice/phpspreadsheet:1.29.7 -
>= 2.0.0, < 2.1.62.1.6composer require phpoffice/phpspreadsheet:2.1.6 -
>= 2.2.0, < 2.3.52.3.5composer require phpoffice/phpspreadsheet:2.3.5 -
>= 3.0.0, < 3.7.03.7.0composer require phpoffice/phpspreadsheet:3.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional sanitization of special characters in hyperlinks before processing Excel files. This can help mitigate the risk of XSS attacks until the library is updated. For example, you can use PHP's htmlspecialchars function to encode special characters in hyperlinks.
Conclusion
CVE-2024-56412 is a significant vulnerability in the PhpSpreadsheet library that allows for XSS attacks through the improper handling of hyperlinks in Excel files. Users are strongly advised to update to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect applications until updates are applied.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-56412 is a vulnerability in the PhpSpreadsheet library that allows attackers to bypass XSS sanitization using the JavaScript protocol and special characters.
If your application uses PhpSpreadsheet and processes Excel files from untrusted sources, it may be susceptible to XSS attacks, allowing attackers to execute arbitrary JavaScript in users' browsers.
Affected versions include 3.6.0, 1.29.6 and earlier, 2.1.5 and earlier, and 2.3.4 and earlier. Users should upgrade to the latest patched versions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, Vulert can alert you to any vulnerabilities, including CVE-2024-56412.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
