| Package | Affected versions | Patched versions |
|---|---|---|
| phpoffice/phpexcel | ≤ 1.8.2 | |
| phpoffice/phpspreadsheet | ≥ 2.0.0, < 2.1.7≥ 2.2.0, < 2.3.6≥ 3.0.0, < 3.8.0< 1.29.8 | 2.1.72.3.63.8.01.29.8 |
| phpspreadsheet | ≥ 2.0.0, < 2.1.7≥ 2.2.0, < 2.3.6≥ 3.0.0, < 3.8.0< 1.29.8 | 2.1.72.3.63.8.01.29.8 |
The researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.
When generating the HTML from an xlsx file containing multiple sheets, a navigation menu is created. This menu includes the sheet names, which are not sanitized. As a result, an attacker can exploit this vulnerability to execute JavaScript code.
// Construct HTML
$html = '';
// Only if there are more than 1 sheets
if (count($sheets) > 1) {
// Loop all sheets
$sheetId = 0;
$html .= '<ul class="navigation">' . PHP_EOL;
foreach ($sheets as $sheet) {
$html .= ' <li class="sheet' . $sheetId . '"><a href="#sheet' . $sheetId . '">' . $sheet->getTitle() . '</a></li>' . PHP_EOL;
++$sheetId;
}
$html .= '</ul>' . PHP_EOL;
}
Create an XLSX file with multiple sheets :
Generate the HTML content
<?php
require __DIR__ . '/vendor/autoload.php';
$inputFileName = 'payload.xlsx';
$spreadsheet = \PhpOffice\PhpSpreadsheet\IOFactory::load($inputFileName);
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
$writer->writeAllSheets();
echo $writer->generateHTMLAll();
?>
XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Example of impacts :
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free