Unauthorized Reflected XSS Vulnerability in PhpSpreadsheet 3.6.0
Summary
CVE-2024-56365: PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.7
>= 2.0.0, < 2.1.6
>= 2.2.0, < 2.3.5
>= 3.0.0, < 3.7.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats, including Excel. It provides a range of functionalities for data manipulation and is widely utilized in PHP applications. However, version 3.6.0 of PhpSpreadsheet contains a critical vulnerability that allows unauthorized users to execute arbitrary JavaScript code through reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the constructor of the Downloader class within the PhpSpreadsheet library. Specifically, the download.php script processes GET parameters without adequate sanitization, allowing attackers to inject malicious scripts. This can lead to the execution of arbitrary JavaScript in the browser of any user accessing the affected script, potentially compromising sensitive information and user sessions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.71.29.7composer require phpoffice/phpspreadsheet:1.29.7 -
>= 2.0.0, < 2.1.62.1.6composer require phpoffice/phpspreadsheet:2.1.6 -
>= 2.2.0, < 2.3.52.3.5composer require phpoffice/phpspreadsheet:2.3.5 -
>= 3.0.0, < 3.7.03.7.0composer require phpoffice/phpspreadsheet:3.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input sanitization for the name and type parameters in the download.php script. For example, you can use PHP's `
htmlspecialchars()` function to encode special characters: `$_GET['name'] = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
` This will help prevent the execution of malicious scripts until the package is updated.
Conclusion
The unauthorized reflected XSS vulnerability in PhpSpreadsheet version 3.6.0 poses a significant risk to applications using this library. It is crucial for developers to update to version 3.7.0 or later to protect against potential attacks. Implementing input sanitization can serve as a temporary measure until the update is applied.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The potential impacts include unauthorized execution of JavaScript code, which can lead to data theft, session hijacking, and other malicious activities affecting users.
Yes, you can implement input sanitization in your application to reduce the risk of exploitation until you can update to the patched version.
The vulnerability was discovered by Aleksey Solovev from Positive Technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
