CVE-2024-45060

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

History

17 Oct 2024, 14:14

Type Values Removed Values Added
CPE cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
First Time Phpoffice phpspreadsheet
Phpoffice
CVSS v2 : unknown
v3 : 7.1
v2 : unknown
v3 : 6.1
References () https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56 - () https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56 - Product
References () https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p - () https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p - Exploit, Mitigation, Third Party Advisory

10 Oct 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) PHPSpreadsheet es una librería PHP pura para leer y escribir archivos de hojas de cálculo. Uno de los scripts de muestra de PhpSpreadsheet es susceptible a una vulnerabilidad de cross-site scripting (XSS) debido a un manejo inadecuado de la entrada donde se espera un número, lo que lleva a la inyección de fórmulas. El código en `45_Quadratic_equation_solver.php` concatena los parámetros suministrados por el usuario directamente en fórmulas de hojas de cálculo. Esto permite que un atacante tome el control de la fórmula y muestre datos no saneados en la página, lo que resulta en la ejecución de JavaScript. Este problema se ha solucionado en las versiones de lanzamiento 1.29.2, 2.1.1 y 2.3.0. Se recomienda a todos los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad.

07 Oct 2024, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-07 21:15

Updated : 2024-10-17 14:14


NVD link : CVE-2024-45060

Mitre link : CVE-2024-45060

CVE.ORG link : CVE-2024-45060


JSON object : View

Products Affected

phpoffice

  • phpspreadsheet
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')