Cross-Site Scripting Vulnerability in PhpSpreadsheet Sample Scripts
Summary
GHSA-v66g-p9x6-v98p: PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file. Affects phpoffice/phpspreadsheet across 3 version ranges.
< 1.29.2
>= 2.0.0, < 2.1.1
>= 2.2.0, < 2.3.0
Fixed in 1.29.2, 2.1.1 or 2.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats. It provides a comprehensive set of features for manipulating spreadsheet data, making it a go-to choice for developers working with Excel files in PHP. However, one of its sample scripts contains a vulnerability that allows for cross-site scripting (XSS) attacks due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the sample script '45_Quadratic_equation_solver.php' where user-supplied parameters are directly concatenated into spreadsheet formulas without proper sanitization. This can lead to formula injection, allowing an attacker to execute arbitrary JavaScript code in the context of the user's browser. The impact is moderate, as these sample files are not typically included in production environments, but they can be inadvertently exposed through certain WordPress plugins that include the entire repository. The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.21.29.2composer require phpoffice/phpspreadsheet:1.29.2 -
>= 2.0.0, < 2.1.12.1.1composer require phpoffice/phpspreadsheet:2.1.1 -
>= 2.2.0, < 2.3.02.3.0composer require phpoffice/phpspreadsheet:2.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can ensure that the parameters are treated as numerical values by using the following code snippet before processing the input:
if (isset($_POST['submit'])) {
$_POST['A'] = floatval($_POST['A']);
$_POST['B'] = floatval($_POST['B']);
$_POST['C'] = floatval($_POST['C']);
}
Conclusion
The XSS vulnerability in PhpSpreadsheet's sample scripts highlights the importance of input validation and sanitization in web applications. While the impact may be limited due to the nature of sample files, it is crucial for developers to address such vulnerabilities to enhance security. Regular updates and monitoring tools like Vulert can help maintain the integrity of your applications.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The vulnerability is an unauthenticated cross-site scripting (XSS) issue that allows attackers to inject and execute JavaScript code through improperly handled user input.
If your application includes the vulnerable sample scripts, it could expose users to XSS attacks, potentially leading to data theft or session hijacking.
No, the vulnerability is present in versions prior to 2.3.0 and 1.29.2. It has been fixed in later releases.
You should update PhpSpreadsheet to the latest version to mitigate the vulnerability. Additionally, review your code to ensure that user inputs are properly sanitized.
You can use tools like Vulert, which monitors your composer.lock file for vulnerabilities in real-time without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
