CVE-2024-56408: Phpspreadsheet Reflected XSS Vulnerability in Convert-Online.php
Summary
CVE-2024-56408: PhpSpreadsheet allows unauthorized Reflected XSS in Convert-Online.php file. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.7
>= 2.0.0, < 2.1.6
>= 2.2.0, < 2.3.5
>= 3.0.0, < 3.7.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Phpspreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It provides a wide range of features for manipulating Excel files and is widely used in web applications for data processing and reporting. However, a critical vulnerability has been identified in the Convert-Online.php script, which allows unauthorized users to exploit the application through reflected cross-site scripting (XSS).
Vulnerability Detail
The vulnerability arises from the lack of input sanitization in the Convert-Online.php file located in the samples directory of Phpspreadsheet. An attacker can craft a malicious request that includes a specially formatted 'quantity' parameter. When this request is processed, the application reflects the input back to the user without proper sanitization, allowing the execution of arbitrary JavaScript code in the victim's browser. This could lead to session hijacking, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.71.29.7composer require phpoffice/phpspreadsheet:1.29.7 -
>= 2.0.0, < 2.1.62.1.6composer require phpoffice/phpspreadsheet:2.1.6 -
>= 2.2.0, < 2.3.52.3.5composer require phpoffice/phpspreadsheet:2.3.5 -
>= 3.0.0, < 3.7.03.7.0composer require phpoffice/phpspreadsheet:3.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the 'quantity' parameter before processing it in your application. This can be done by using PHP functions such as htmlspecialchars() to escape any HTML characters. For example:
$quantity = htmlspecialchars($_POST['quantity'], ENT_QUOTES, 'UTF-8');
Conclusion
In summary, CVE-2024-56408 is a critical reflected XSS vulnerability in the Phpspreadsheet library that can be exploited by unauthorized users. It is essential to update to the latest version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The CVSS score of this vulnerability is 8.2 according to CVSS v3.1 and 8.3 according to CVSS v4.0, indicating a high severity level.
The vulnerability was discovered by Aleksey Solovev from Positive Technologies.
The potential impacts include executing arbitrary JavaScript code in the user's browser, which can lead to session hijacking, data theft, or other malicious actions.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup at Vulert Scanner.
Yes, you can implement input validation and sanitization for the 'quantity' parameter as a temporary measure until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
