PhpSpreadsheet Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in PhpSpreadsheet versions 3.0.0 prior to 3.8.0, 1.29.8 prior to 2.1.7, and 2.2.0 prior to 2.3.6. The vulnerability arises in the HTML generation process from XLSX files, where sheet titles are not properly sanitized before being displayed. This flaw allows attackers to inject and execute JavaScript code by crafting an XLSX file with a malicious title.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser. This could lead to session hijacking, redirection to phishing sites, modification of page content, automatic downloads of malicious files, or unauthorized access to the user's geolocation or camera.

Reproduction

To reproduce this vulnerability, create an XLSX file with multiple sheets. Include a title in one of the sheets that contains JavaScript code, such as an image tag with an 'onerror' event. Once the file is prepared, use PhpSpreadsheet to load the file and write it as HTML. The generated HTML will include the unsanitized sheet title, executing the injected JavaScript.

Remediation

Users can upgrade to PhpSpreadsheet versions 3.8.0, 1.29.8, 2.1.7, or 2.3.6 to address this vulnerability.