CVE-2024-45046: PhpSpreadsheet HTML writer Cross-Site Scripting Vulnerability

Background

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. It provides functionality to handle various spreadsheet formats and perform operations on them. The library is widely used in PHP applications for manipulating spreadsheet data. However, a vulnerability has been discovered in the HTML writer component of PhpSpreadsheet, which allows for Cross-Site Scripting (XSS) attacks.

Vulnerability Detail

The vulnerability exists in the \PhpOffice\PhpSpreadsheet\Writer\Html class, which is responsible for generating HTML output from spreadsheet data. The class does not properly sanitize styling information, such as font names, allowing an attacker to inject arbitrary JavaScript code into the generated HTML. This can lead to the execution of malicious scripts in the context of the user's browser, potentially leading to session hijacking or other forms of attack.

Workaround

If updating the package is not immediately possible, a temporary workaround is to manually sanitize the styling information before generating the HTML output. This can be done by using a library or function that properly sanitizes user input, such as the htmlspecialchars function in PHP. Here's an example of how to apply this workaround:

<?php

require 'vendor/autoload.php';

$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);

// Sanitize styling information
$writer->setUseInlineCss(true);
$writer->setCssStylesheet('');

print($writer->generateHTMLAll());

By setting the setUseInlineCss method to true and providing an empty CSS stylesheet, the styling information is effectively sanitized, preventing the XSS vulnerability.

Conclusion

The PhpSpreadsheet HTML writer component is vulnerable to Cross-Site Scripting (XSS) attacks due to improper sanitization of styling information. Developers should update to version 2.1.0 or later of the phpoffice/phpspreadsheet package to fix the vulnerability. A temporary workaround is available by manually sanitizing the styling information before generating the HTML output. It is recommended to regularly check for vulnerabilities in your application using tools like Vulert.

See every vulnerability recorded for phpoffice/phpspreadsheet →

FAQ