CVE-2024-56411: PhpSpreadsheet Cross-Site Scripting Vulnerability in HTML Header
Summary
CVE-2024-56411: Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-si... Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.7
>= 2.0.0, < 2.1.6
>= 2.2.0, < 2.3.5
>= 3.0.0, < 3.7.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PhpSpreadsheet is a popular open-source library for reading and writing spreadsheet files in PHP. It allows developers to create, read, and manipulate Excel files in various formats, including XLSX and CSV. The library is widely used due to its ease of use and comprehensive feature set. However, it has been found to have a Cross-Site Scripting (XSS) vulnerability that arises from improper handling of hyperlink base in the HTML page header, potentially exposing users to malicious scripts.
Vulnerability Detail
The vulnerability originates from the way PhpSpreadsheet generates HTML representations of Excel files without properly sanitizing the hyperlink base. An attacker can exploit this flaw by embedding malicious JavaScript code in the properties of an Excel file. When a user opens a specially crafted Excel file, the malicious code can be executed in the user's browser, leading to unauthorized actions or data theft. The affected component is the 'generateHTMLHeader' method in the 'PhpOffice\PhpSpreadsheet\Writer\Html' class, which fails to sanitize user input adequately.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.71.29.7composer require phpoffice/phpspreadsheet:1.29.7 -
>= 2.0.0, < 2.1.62.1.6composer require phpoffice/phpspreadsheet:2.1.6 -
>= 2.2.0, < 2.3.52.3.5composer require phpoffice/phpspreadsheet:2.3.5 -
>= 3.0.0, < 3.7.03.7.0composer require phpoffice/phpspreadsheet:3.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional sanitization of special characters in the hyperlink base string before it is processed by PhpSpreadsheet. This can help mitigate the risk of XSS attacks until the library is updated.
Conclusion
The CVE-2024-56411 vulnerability in PhpSpreadsheet poses a significant risk due to its potential for Cross-Site Scripting attacks. Users are strongly advised to update to the latest versions of the library to mitigate this risk and ensure the safety of their applications.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-56411 is a Cross-Site Scripting (XSS) vulnerability found in the PhpSpreadsheet library that allows attackers to execute arbitrary JavaScript code in the user's browser.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
The risks include unauthorized execution of JavaScript code, which can lead to data theft, session hijacking, or other malicious activities affecting users of the application.
To protect users, update PhpSpreadsheet to the latest patched version as soon as possible and consider implementing additional input sanitization as a temporary measure.
The vulnerability was discovered by Aleksey Solovev from Positive Technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
