Downloader
classProduct: Phpspreadsheet
Version: version 3.6.0
CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS vector v.3.1: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)
CVSS vector v.4.0: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)
Description: using the /vendor/phpoffice/phpspreadsheet/samples/download.php
script, an attacker can perform a XSS-type attack
Impact: execution of arbitrary JavaScript code in the browser
Vulnerable component: the constructor of the Downloader
class
Exploitation conditions: an unauthorized user
Mitigation: sanitization of the name
and type
variables
Researcher: Aleksey Solovev (Positive Technologies)
The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in the constructor of the Downloader
class) in Phpspreadsheet.
The latest version (3.6.0) of the phpoffice/phpspreadsheet
library was installed. The installation was carried out with the inclusion of examples.
Listing 1. Installing the phpoffice/phpspreadsheet
library
$ composer require phpoffice/phpspreadsheet --prefer-source
The ./vendor/phpoffice/phpspreadsheet/samples/download.php
file processes the GET parameters name
and type
.
Figure 1. The ./vendor/phpoffice/phpspreadsheet/samples/download.php
file accepts GET parameters.
Consider the constructor of the Downloader
class, where GET parameters are passed. Error is displayed without sanitization using GET parameters transmitted from the user.
Figure 2. Error is displayed without sanitization
When clicking on the following link, arbitrary JavaScript code will be executed.
Listing 2.
https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/download.php?name=%3Cimg%20src=1%20onerror=alert()%3E&type=1
Demonstration of the execution of arbitrary JavaScript code.
<img width="537" alt="fig3" src="https://github.com/user-attachments/assets/745d6e21-396f-4357-8ff8-e856adf15fee" />
Figure 3. Executing arbitrary JavaScript code
This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
{ "nvd_published_at": "2025-01-03T17:15:08Z", "cwe_ids": [ "CWE-79" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-01-03T17:06:05Z" }