CVE-2024-45060: PhpSpreadsheet Unauthenticated XSS Vulnerability in Sample File
Summary
CVE-2024-45060: PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.2
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.3.0
Fixed in 1.29.2, 2.1.1 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It provides a wide range of features, including support for various file formats, formulas, and formatting options. However, one of its sample scripts, specifically '45_Quadratic_equation_solver.php', has been found to be vulnerable to an unauthenticated cross-site scripting (XSS) attack due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the way user-supplied parameters are directly concatenated into spreadsheet formulas without proper sanitization. This allows an attacker to inject malicious JavaScript code, which can be executed in the context of the user's browser. The affected code is located in '45_Quadratic_equation_solver.php', where user inputs for parameters A, B, and C are used to construct formulas. If an attacker crafts a specific input, they can manipulate the output to execute arbitrary JavaScript, potentially leading to data theft or session hijacking.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.21.29.2composer require phpoffice/phpspreadsheet:1.29.2 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.3.02.3.0composer require phpoffice/phpspreadsheet:2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only numerical values are accepted for parameters A, B, and C. This can be done by using the floatval() function in PHP as shown in the code snippet provided in the 'how_to_fix' section.
Conclusion
The XSS vulnerability in PhpSpreadsheet's sample file poses a risk to applications that inadvertently expose this file. It is crucial for developers to update to the latest versions and implement input validation to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The vulnerability is an unauthenticated cross-site scripting (XSS) issue that allows attackers to inject and execute JavaScript code through manipulated user input.
If your application uses PhpSpreadsheet and includes the sample files, particularly '45_Quadratic_equation_solver.php', it may be vulnerable. You can check for vulnerabilities using Vulert without any signup.
The potential impacts include unauthorized access to user data, session hijacking, and the execution of malicious scripts in the user's browser.
Yes, the vulnerability has been patched in PhpSpreadsheet versions 2.3.0 and 1.29.2. Users are advised to update to these versions or higher.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
