| Package | Affected versions | Patched versions |
|---|---|---|
| phpoffice/phpexcel | ≤ 1.8.2 | |
| phpoffice/phpspreadsheet | ≥ 2.0.0, < 2.1.0< 1.29.1 | 2.1.01.29.1 |
| phpspreadsheet | ≥ 2.0.0, < 2.1.0< 1.29.1 | 2.1.01.29.1 |
\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
Save this file in the same directory: book.xlsx
Open index.php in a web browser. An alert should be displayed.
Full takeover of the session of users viewing spreadsheet files as HTML.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free