Listen to this Post
The vulnerability exists within the `\PhpOffice\PhpSpreadsheet\Writer\Html` class. When generating HTML output from a spreadsheet, this class processes styling information such as font names from cell definitions. These values are read from the spreadsheet file (e.g., XLSX) and embedded directly into the resulting HTML document without proper sanitization or escaping. An attacker can craft a malicious spreadsheet file where a cell’s font name contains arbitrary JavaScript code, for example: <script>alert('XSS')</script>. When the `generateHTMLAll()` method is called, the malicious font name is written into a `style` attribute within a `` tag in the output. Because the content is not encoded for an HTML context, the browser interprets the injected script as executable code when the generated HTML page is viewed.
Platform: PhpSpreadsheet Library
Version: < 1.29.0
Vulnerability: Stored XSS
Severity: Critical
Date: 2024-03-21
Prediction: Patched 2024-03-21
What Undercode Say:
Analytics
`grep -r “font.style” src/PhpSpreadsheet/Writer/Html/`
`find . -name “.php” -exec grep -l “generateHTMLAll” {} \;`
`php -r “$s=new \PhpOffice\PhpSpreadsheet\Spreadsheet(); $s->getActiveSheet()->setCellValue(‘A1’, ‘test’); $s->getActiveSheet()->getStyle(‘A1’)->getFont()->setName(‘Arial"`.
Serve HTML output.
Protection from this CVE
Update to >=1.29.0.
Validate/Sanitize input.
Escape HTML attributes.
Impact:
Stored Cross-Site Scripting.
Session Hijacking.
Client-side compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
