PhpSpreadsheet Hyperlink Base Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in PhpSpreadsheet, a PHP library for reading and writing spreadsheet files. This issue affects versions 3.6.0, 2.3.4, 2.1.5, and 1.29.6. The vulnerability arises because the HTML page header is generated without properly sanitizing the hyperlink base, allowing for the execution of arbitrary JavaScript in the browser. The issue is present in the 'Html' writer component, specifically within the 'generateHTMLHeader' method.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript code in the browser of a user viewing a specially crafted Excel file.

Reproduction

To reproduce this vulnerability, create an Excel file (XLSX format) and insert a payload into the hyperlink base property. This can be done by modifying the 'docProps/app.xml' file of the Excel file to include a malicious hyperlink base. Once the file is saved, it can be opened with a vulnerable version of PhpSpreadsheet. The 'Html' writer will generate an HTML representation of the spreadsheet, including the unsanitized hyperlink base, which will trigger the XSS vulnerability by executing the embedded JavaScript payload.

Remediation

Users can update to PhpSpreadsheet versions 3.7.0, 2.3.5, 2.1.6, or 1.29.7, all of which contain the necessary patch to address this vulnerability.