GHSA-r8w8-74ww-j4whmedium5.4

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

The advisory, in context

Summary

\PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability.

PoC

Example target script:

<?php

require 'vendor/autoload.php';

$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());

Save this file in the same directory: book.xlsx

Open index.php in a web browser and click on both links. The first demonstrates the vulnerability in a regular hyperlink and the second in a HYPERLINK() formula.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

phpoffice/phpspreadsheet Packagist

Ecosystem versions

From 2.2.0 before 2.3.0

Fixed in 2.3.0

3 explicitly affected versions

2.2.0, 2.2.1, 2.2.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.2.0"
        },
        {
          "fixed": "2.3.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.2.0",
    "2.2.1",
    "2.2.2"
  ]
}

phpoffice/phpspreadsheet Packagist

Ecosystem versions

Earlier releases before 1.29.2

Fixed in 1.29.2

47 explicitly affected versions

1.0.0, 1.0.0-beta, 1.0.0-beta2, 1.1.0, 1.10.0, 1.10.1, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.14.1, 1.15.0, 1.16.0, 1.17.0, 1.17.1, 1.18.0, 1.19.0, 1.2.0, 1.2.1, 1.20.0, 1.21.0, 1.22.0, 1.23.0, 1.24.0, 1.24.1, 1.25.0, 1.25.1, 1.25.2, 1.26.0, 1.27.0, 1.27.1, 1.28.0, 1.29.0, 1.29.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 1.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.29.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.0-beta",
    "1.0.0-beta2",
    "1.1.0",
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.14.0",
    "1.14.1",
    "1.15.0",
    "1.16.0",
    "1.17.0",
    "1.17.1",
    "1.18.0",
    "1.19.0",
    "1.2.0",
    "1.2.1",
    "1.20.0",
    "1.21.0",
    "1.22.0",
    "1.23.0",
    "1.24.0",
    "1.24.1",
    "1.25.0",
    "1.25.1",
    "1.25.2",
    "1.26.0",
    "1.27.0",
    "1.27.1",
    "1.28.0",
    "1.29.0",
    "1.29.1",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.4.1",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.9.0"
  ]
}

phpoffice/phpspreadsheet Packagist

Ecosystem versions

From 2.0.0 before 2.1.1

Fixed in 2.1.1

2 explicitly affected versions

2.0.0, 2.1.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.0.0"
        },
        {
          "fixed": "2.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.1.0"
  ]
}

phpoffice/phpexcel Packagist

Ecosystem versions

Earlier releases through 1.8.2 (inclusive)

No fix recorded for this interval.

9 explicitly affected versions

1.7.9, 1.7.9-rc1, 1.8.0, 1.8.0rc1, 1.8.0rc2, 1.8.0rc3, 1.8.0rc4, 1.8.1, 1.8.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "1.8.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.7.9",
    "1.7.9-rc1",
    "1.8.0",
    "1.8.0rc1",
    "1.8.0rc2",
    "1.8.0rc3",
    "1.8.0rc4",
    "1.8.1",
    "1.8.2"
  ]
}

Set up in your agent.

Investigate in your agent.

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

The advisory, in context

Summary

PoC

Affected packages

References