CVE-2020-7776: Cross-site scripting in phpoffice/phpspreadsheet
Summary
CVE-2020-7776: Cross-site scripting in phpoffice/phpspreadsheet. Affects phpoffice/phpspreadsheet versions < 1.16.0. Fixed in 1.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package phpoffice/phpspreadsheet is a library used for working with spreadsheet files in PHP. It provides functionality to read, write, and manipulate Excel files. The vulnerability in this package allows for cross-site scripting (XSS) attacks when generating an HTML output from an Excel file by adding a comment to any cell. The issue lies in the HTML writer, where user comments are concatenated as part of a link, which is then returned as HTML.
Vulnerability Detail
The vulnerability in phpoffice/phpspreadsheet allows an attacker to inject malicious code into the HTML output generated from an Excel file. By adding a comment to a cell, the attacker can exploit the concatenation of user comments as part of a link, leading to the execution of arbitrary JavaScript code in the context of the victim's browser. This can result in various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim.
How To Fix
Minimum fixed version
1.16.0
This is the first release that contains the fix.
composer require phpoffice/phpspreadsheet:1.16.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of phpoffice/phpspreadsheet to mitigate the risk of XSS attacks.
Conclusion
The vulnerability in phpoffice/phpspreadsheet allows for cross-site scripting (XSS) attacks when generating an HTML output from an Excel file. It is crucial to upgrade to version 1.16.0 or later of the package to mitigate the risk of XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
phpoffice/phpspreadsheet is a PHP library for working with spreadsheet files, providing functionality to read, write, and manipulate Excel files.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the victim's browser.
The vulnerability occurs when generating an HTML output from an Excel file by adding a comment to a cell. User comments are concatenated as part of a link in the HTML output, allowing an attacker to inject malicious code.
The vulnerability can be exploited to execute arbitrary JavaScript code in the victim's browser. This can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim.
To fix this vulnerability, it is recommended to upgrade to version 1.16.0 or later of phpoffice/phpspreadsheet, which includes a fix for the XSS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
