| Package | Affected versions | Patched versions |
|---|---|---|
| phpoffice/phpexcel | ≤ 1.8.2 | |
| phpoffice/phpspreadsheet | ≥ 2.0.0, < 2.1.1≥ 2.2.0, < 2.3.0< 1.29.2 | 2.1.12.3.01.29.2 |
| phpspreadsheet | ≥ 2.0.0, < 2.1.1≥ 2.2.0, < 2.3.0< 1.29.2 | 2.1.12.3.01.29.2 |
\PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability.
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
Save this file in the same directory: book.xlsx
Open index.php in a web browser and click on both links. The first demonstrates the vulnerability in a regular hyperlink and the second in a HYPERLINK() formula.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free