CVE-2024-56410: PhpSpreadsheet Cross-Site Scripting (XSS) Vulnerability in Custom Properties
Summary
CVE-2024-56410: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.7
>= 2.0.0, < 2.1.6
>= 2.2.0, < 2.3.5
>= 3.0.0, < 3.7.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats, including Excel. It provides a range of features for manipulating spreadsheet data programmatically. However, a vulnerability has been identified in version 3.6.0, where custom properties can be exploited to execute arbitrary JavaScript code, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, specifically in the handling of custom properties within Excel files. When an Excel file containing malicious custom properties is processed, the library generates an HTML representation without sanitizing these properties. This oversight allows attackers to embed JavaScript code that executes in the browser of any user viewing the generated HTML, potentially leading to data theft or other malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.71.29.7composer require phpoffice/phpspreadsheet:1.29.7 -
>= 2.0.0, < 2.1.62.1.6composer require phpoffice/phpspreadsheet:2.1.6 -
>= 2.2.0, < 2.3.52.3.5composer require phpoffice/phpspreadsheet:2.3.5 -
>= 3.0.0, < 3.7.03.7.0composer require phpoffice/phpspreadsheet:3.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, sanitize any custom properties before including them in the Excel file. This can be done by escaping special characters in the property names and values to prevent the execution of any embedded scripts.
Conclusion
The Cross-Site Scripting vulnerability in PhpSpreadsheet highlights the importance of input sanitization in web applications. By updating to the latest version and implementing proper sanitization practices, users can protect their applications from potential exploits.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2024-56410 is a vulnerability in PhpSpreadsheet that allows for Cross-Site Scripting (XSS) through unsanitized custom properties in Excel files.
If you are using PhpSpreadsheet version 3.6.0 or earlier, your application may be vulnerable. You can check your composer.lock file or use Vulert's playground to verify.
The vulnerability can lead to the execution of arbitrary JavaScript code in the browser, which may result in data theft, session hijacking, or other malicious activities.
Yes, you can use Vulert, which monitors your composer.lock file for open-source vulnerabilities in real-time, providing alerts for any issues.
If immediate updates are not possible, implement input sanitization for custom properties as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
