HighGHSA-jmpx-686v-c3wxCVE-2024-56365

PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

Published 3 Jan 2025 · Updated 6 Mar 2025

Affected packages

phpoffice/phpspreadsheetComposer
Affected
>=3.0.0 <3.7.0
Fixed in
3.7.0
Update to the fixed version for your release line, for example:composer require phpoffice/phpspreadsheet:^3.7.0
phpoffice/phpspreadsheetComposer
Affected
<1.29.7
Fixed in
1.29.7
Update to the fixed version for your release line, for example:composer require phpoffice/phpspreadsheet:^1.29.7
phpoffice/phpspreadsheetComposer
Affected
>=2.0.0 <2.1.6
Fixed in
2.1.6
Update to the fixed version for your release line, for example:composer require phpoffice/phpspreadsheet:^2.1.6
phpoffice/phpspreadsheetComposer
Affected
>=2.2.0 <2.3.5
Fixed in
2.3.5
Update to the fixed version for your release line, for example:composer require phpoffice/phpspreadsheet:^2.3.5
phpoffice/phpexcelComposer
Affected
<=1.8.2
Fixed in
No fix released

Details

Unauthorized Reflected XSS in the constructor of the Downloader class

Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS vector v.3.1: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) CVSS vector v.4.0: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) Description: using the /vendor/phpoffice/phpspreadsheet/samples/download.php script, an attacker can perform a XSS-type attack Impact: execution of arbitrary JavaScript code in the browser Vulnerable component: the constructor of the Downloader class Exploitation conditions: an unauthorized user Mitigation: sanitization of the name and type variables Researcher: Aleksey Solovev (Positive Technologies)

Research

The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in the constructor of the Downloader class) in Phpspreadsheet.

The latest version (3.6.0) of the phpoffice/phpspreadsheet library was installed. The installation was carried out with the inclusion of examples.

*Listing 1. Installing the phpoffice/phpspreadsheet library*

$ composer require phpoffice/phpspreadsheet --prefer-source

The ./vendor/phpoffice/phpspreadsheet/samples/download.php file processes the GET parameters name and type.

!fig1

*Figure 1. The ./vendor/phpoffice/phpspreadsheet/samples/download.php file accepts GET parameters.*

Consider the constructor of the Downloader class, where GET parameters are passed. Error is displayed without sanitization using GET parameters transmitted from the user.

!fig2

*Figure 2. Error is displayed without sanitization*

When clicking on the following link, arbitrary JavaScript code will be executed.

*Listing 2.*

https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/download.php?name=%3Cimg%20src=1%20onerror=alert()%3E&type=1

Demonstration of the execution of arbitrary JavaScript code.

<img width="537" alt="fig3" src="https://github.com/user-attachments/assets/745d6e21-396f-4357-8ff8-e856adf15fee" />

*Figure 3. Executing arbitrary JavaScript code*

Credit

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Is GHSA-jmpx-686v-c3wx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpoffice/phpspreadsheet, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.